Topic starter
26/01/2026 11:58 am
TL;DR: Opal Security argues that AI agents and other non-human identities now perform the majority of actions in modern stacks, and legacy access models built for people cannot contain their dynamic, cross-service behaviour. Identity governance has to shift from static roles and periodic review to scoped, automated, lifecycle-aware control before authorization becomes a liability.
Editorial analysis by NHI Mgmt Group, based on content published by Opal Security: “The Rise of Non-Human Identities: Why AI Agents Break Traditional Access Models”.
Key questions
Q: What breaks when access models are designed for people instead of non-human identities?
A: Human-centric access models break when identities are transient, system-initiated, and hard to map to a stable role.
Q: Why do AI agents increase the risk of data exfiltration in IAM programmes?
A: AI agents increase risk because they can operate continuously, chain multiple tools, and reuse standing credentials across systems.
Q: How can security teams tell whether NHI governance is working?
A: They should look for fewer orphaned accounts, shorter credential lifetimes, lower secret reuse and faster decommissioning when systems or projects end.
Practitioner guidance
- Map all NHI ownership and lifecycle gaps Inventory service accounts, automation tools, cloud resources, and AI agents under a named owner and explicit offboarding path.
- Replace static roles with functional scopes Define entitlements by task, system, and duration so non-human identities receive only the narrow access needed for the current workflow.
- Automate revocation for ephemeral access Build revocation triggers into provisioning, job completion, and exception handling so access ends when the workflow ends.
Bottom line: Non-human identities and AI agents expose a structural mismatch in access governance because they do not behave like employees with durable roles and reviewable sessions.
What's in the full article
Opal Security's full article covers the operational detail this post intentionally leaves for the source:
- The article's explicit design-assumption table showing how human IAM assumptions diverge from NHI reality
- The discussion of how AI agents request access dynamically across services and why that breaks static role design
- The operational tradeoff between overprovisioning to avoid friction and constraining access to reduce attack surface
- The article's framing of lifecycle ownership and revocation as the missing controls for modern NHI governance
👉 Read Opal Security's analysis of how AI agents break traditional access models →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
07/10/2026 7:51 pm
Legacy IAM assumes access is requested by people, not initiated by systems. That assumption holds when workflows are human-paced and ownership is obvious. It fails when identities are transient, auto-generated, and triggered by code, orchestration, or AI agents. The implication is that governance has to move from user-centric review cycles to lifecycle control for machine-driven access.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: What is the difference between periodic access review and continuous NHI enforcement?
A: Periodic review checks access after the fact, while continuous enforcement constrains access as it is issued and used. For NHIs and AI agents, that difference matters because privilege can be created, consumed, and discarded inside a window too short for a review cycle to catch. Continuous enforcement aligns control with runtime behaviour.
👉 Read our full editorial: AI agents break traditional access models for NHI governance