Topic starter
25/06/2026 12:20 am
TL;DR: Machine identities and AI agents now authenticate, access data, and execute workflows at machine speed, expanding enterprise attack surface and privilege sprawl, according to Delinea. The governance problem is no longer just access control, but whether identity programmes can keep trust boundaries visible as autonomy and entitlement multiply.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “The rise of machine identities and agentic AI: Securing trust in the next era of digital autonomy”.
Key questions
Q: How can teams govern machine identities and AI agents in access reviews?
A: Teams should assign ownership, define review cadence, and include machine identities and AI agents in the same certification logic as human access, but with role-appropriate approvers.
Q: Why do machine identities and agentic AI complicate traditional identity security programmes?
A: They complicate programmes because the number of non-human actors grows faster than manual governance processes can track.
Q: How do security teams know if machine identity governance is working?
A: Look for fewer standing accounts, faster onboarding of automation workflows, auditable role approvals, and visible retention of access records after logout.
Practitioner guidance
- Discover every credentialed actor Inventory service accounts, API keys, tokens, certificates, and AI-linked identities across SaaS, cloud, and on-prem environments.
- Classify replicated privilege paths Identify where one human account or workflow can spawn multiple non-human identities with overlapping access.
- Remove standing credentials from high-risk workflows Replace persistent access with short-lived issuance where the workflow can tolerate it, and rotate secrets automatically when long-lived credentials are unavoidable.
Bottom line: Machine identities and agentic AI turn identity governance into a runtime trust problem, not just an access administration problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:15 am
Machine identities are now first-class trust actors, not backend implementation details. Delinea’s framing is directionally correct: once service accounts, tokens, and AI-linked credentials can independently access data and systems, identity governance stops being a human-only discipline. The operational problem is not volume alone, but that these actors can exercise trust across multiple environments without a single human review point. Practitioners should treat machine identity governance as core IAM, not as an adjacent engineering task.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: Organisations should define AI agents as governed identities, not informal automations. That means assigning ownership, scoping access tightly, reviewing delegation paths, and setting lifecycle controls for provisioning and revocation. If an agent can act, delegate, or chain requests, it needs policy boundaries and monitoring comparable to other high-risk identities.
👉 Read our full editorial: Machine identities and agentic AI are reshaping trust boundaries