Topic starter
14/05/2026 2:33 pm
TL;DR: AI agents are pushing identity lifecycle management, user access reviews, and change control beyond human-only assumptions, according to SailPoint. The audit problem is no longer whether controls exist, but whether they cover every non-human identity that can act inside material business processes.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “The ghost in the machine: Why AI agents are the next frontier for IT audit”.
Key questions
Q: What breaks when AI agents are treated like standard human users?
A: You lose visibility into effective permissions, expected behaviour, and real blast radius.
Q: Why do user access reviews miss the real risk from AI agents?
A: They only test the user’s direct entitlements, not the broader actions the user can trigger through an agent.
Q: How should organisations audit AI agents inside ITGC controls?
A: They should inventory agents as governed identities, recertify effective access, and require change evidence for creation, approval, and deployment.
Practitioner guidance
- Inventory every production AI agent Create a complete register of each AI agent, service account, and bot in scope for material business processes, including owner, purpose, and system access.
- Recertify effective access, not just direct entitlements Include delegated paths, downstream permissions, and agent-to-agent links in access reviews so a clean human review does not mask expanded execution rights.
- Add agent records to change control Require documented approval, testing evidence, access grant, and retirement criteria before an agent is moved into production.
Bottom line: AI agents expose a basic mismatch between human-oriented ITGC processes and the identities now operating inside production workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
14/05/2026 2:35 pm
ITGC was built for human-paced governance, and that assumption breaks when AI agents become production actors. Lifecycle controls, access reviews, and change management all rely on identities that can be inventoried, owned, and revalidated within stable operational cycles. Agents can be created, repurposed, and embedded in business processes faster than those cycles were designed to observe. The implication is not just more work for auditors, but a different control object entirely.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams secure AI agents before they are embedded into business workflows?
A: Security teams should treat AI agents as a distinct identity and access problem, not just an application feature. The first step is to inventory agent activity, define allowed actions, and constrain access to only the data and systems each agent needs. Governance should include monitoring, policy enforcement, and review of agent decisions so unintended actions are detected early.
👉 Read our full editorial: AI agent governance is exposing ITGC gaps in enterprise audit
This post was modified 7 days ago by NHI Mgmt Group