Topic starter
13/10/2026 1:21 pm
TL;DR: The assumption that access can be managed separately by identity type is breaking down, according to Saviynt, which says its AI-powered identity platform now spans human and non-human access, including an MCP server and ISPM for AI agents, signalling that identity governance is moving from workforce-only controls to broader machine and agent oversight. The assumption that access can be managed separately by identity type is breaking down.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Newsroom”.
Key questions
Q: What breaks when human IAM and NHI governance are handled in separate programmes?
A: Ownership, review, and revocation drift apart, so the organisation cannot prove who approved access, who operates it, or when it should end.
Q: Why do MCP-connected AI workflows create new governance risk?
A: MCP-connected workflows expand the identity perimeter because a model can act through tools and data sources rather than only through a human user session.
Q: How can security teams tell whether AI agent access is drifting out of scope?
A: Look for agents touching systems, data sets, or tools that are outside the intended task boundary, especially when those actions are not part of the approved workflow.
Practitioner guidance
- Inventory AI agent and NHI entry points Map every AI agent, service account, API credential, and delegated workflow that can reach business systems, then assign a named owner and lifecycle path for each one.
- Unify recertification across actor types Use one review process for human identities, machine identities, and agent identities so standing privilege, orphaned access, and stale ownership are visible in the same cycle.
- Treat MCP connections as governed trust paths Document which tools and data sources each MCP-connected workflow can reach, then review whether delegated access still matches the intended task boundary.
Bottom line: Identity governance is no longer bounded by workforce access alone, because AI agents and machine identities now sit inside the same execution paths as human users.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
13/10/2026 1:22 pm
Identity governance is converging around execution, not just authentication. The practical boundary is shifting from who logged in to what identity is allowed to do across applications, data, and business processes. That is why human access, service accounts, and AI agents can no longer be governed as separate programme tracks. Practitioners should treat access orchestration as a single governance surface with different actor types, not three disconnected control domains.
A question worth separating out:
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.
👉 Read our full editorial: Saviynt's AI identity platform and MCP server widen governance scope