Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: Least privilege must be treated as an operating model spanning humans, non-human identities, and AI agents, with the strongest signal being its emphasis on AI agent security across multiple platforms, according to Veza. The central issue is that governance based on static permissions and periodic review cannot keep pace with runtime identity behaviour.
NHIMG editorial — based on content published by Veza: AI The Identity Security Maturity Model: A Roadmap to Least Privilege
Questions worth separating out
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect.
Q: When does least privilege fail in modern identity environments?
A: It fails when privilege is treated as a static assignment rather than an evolving execution state.
Q: What do organisations get wrong about IAM maturity?
A: They often confuse tool adoption with control coverage.
Practitioner guidance
- Map identity controls by actor type Separate human, NHI, and AI agent governance so each has defined ownership, lifecycle steps, and review cadence.
- Validate effective privilege, not just assigned entitlement Compare the permissions in directory or policy systems with the paths identities actually use in production.
- Tie revocation to lifecycle events Require offboarding, rotation, and entitlement removal to be triggered by identity lifecycle changes, not manual cleanup.
What's in the full article
Veza's full article covers the operational detail this post intentionally leaves for the source:
- The maturity model stages and how Veza maps them to least-privilege progress.
- Platform-specific AI agent security coverage across Microsoft Copilot Studio, Amazon Bedrock Agents, Azure AI Foundry, ServiceNow AI Agents, and Vertex AI.
- The product update cadence behind the AI agent security programme and how the vendor positions each release.
- The remediating workflow examples that connect identity insight to downstream action in adjacent systems.
👉 Read Veza's identity security maturity model for least privilege →
Identity security maturity model for least privilege: what changes?
Explore further
25/08/2026 6:11 pm
Identity maturity is now a cross-actor governance discipline, not a human IAM programme with a few machine add-ons. Veza's framing reflects the reality that modern identity sprawl spans employees, service accounts, workloads, and AI agents. The discipline changes because each actor type fails in a different way, but the governance model has to bind them together through discovery, ownership, and lifecycle control.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
A question worth separating out:
Q: What is the difference between entitlement review and runtime governance for AI agents?
A: Entitlement review checks what access was granted. Runtime governance checks what the agent actually does with that access while it is executing. For AI agents, that distinction matters because tool selection, action timing, and side effects can change inside a single session, which means review alone cannot capture exposure.
👉 Read our full editorial: Veza's identity security maturity model reframes least privilege
