Topic starter
03/06/2026 11:52 am
TL;DR: NHIs already outnumber human users by 500:1 in some environments and credential abuse remains a leading attack vector, while a 2026 Gravitee survey found only 24.4% of organisations have full visibility into AI agents, according to Saviynt and cited research. Identity governance now has to handle predictable machine identities and runtime-deciding agents with different control assumptions.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “NHIs vs. AI Agents: Why Your Identity Program Needs to See Both”.
Key questions
Q: What breaks when AI agents are governed like ordinary service principals?
A: The main failure is that ordinary service-principal governance assumes a stable workload with predictable lifecycle and entitlement patterns.
Q: Why do AI agents increase non-human identity risk?
A: AI agents increase non-human identity risk because they can execute many actions quickly once they inherit a credential or tool permission.
Q: How can organisations tell whether an AI agent is acting outside its intended scope?
A: Organisations should look for behaviour that crosses expected tool boundaries, generates unusual credentials, or chains actions across systems that are not part of the original task.
Practitioner guidance
- Define separate governance classes for NHIs and AI agents Map service accounts, API keys and certificates to one lifecycle path, and map AI agents to a separate path that includes runtime behaviour, ownership and task scope.
- Inventory credential creation by agents Track where AI agents generate tokens, delegated sessions, scoped API keys and sub-agent credentials during execution.
- Tie every agent to an accountable owner Require a named business or technical owner for each AI agent, with explicit offboarding criteria when the project ends or the access pattern changes.
Bottom line: AI agents change the governance problem because they can make decisions and generate credentials during execution, while NHIs generally follow predefined instructions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
03/06/2026 11:55 am
NHIs and AI agents are not the same governance problem: Both may authenticate with the same credential types, but only AI agents can alter behaviour, tool choice and access path at runtime. That means NHI governance assumptions about repeatable execution and stable intent no longer hold across the full identity estate. Practitioners should stop treating machine identity as a single control category and distinguish predictable execution from autonomous action.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams govern AI agents and NHIs differently?
A: Security teams should govern NHIs as predictable machine identities and AI agents as runtime actors that can alter behaviour after authentication. That means static entitlements, inventory, and rotation remain central for NHIs, while agents need behaviour monitoring, delegation tracing, and ownership controls that account for tool choice and execution timing.
👉 Read our full editorial: NHIs vs. AI agents: why identity governance must see both