Topic starter
11/12/2025 4:10 pm
TL;DR: Enterprises are adding autonomous AI agents faster than identity controls were designed to govern them, and Delinea argues that current IAM and IGA processes must be extended for onboarding, authorization, and oversight of delegated and independently credentialed agents. The core issue is assumption collapse: review cycles, least privilege, and lifecycle controls were built for stable human or machine identities, not actors that make runtime decisions at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Are identity management solutions ready for a digital AI-based workforce?”.
By the numbers:
- 85% of organizations have begun implementing AI, according to Delinea.
- 75% of enterprises are seeing a positive ROI from AI assistants, according to Delinea.
Key questions
Q: What breaks when teams treat autonomous agents like service accounts?
A: Teams lose visibility into dynamic decision-making, tool choice, and action timing.
Q: Why do autonomous AI systems create more identity risk than normal automation?
A: Normal automation follows a fixed path, but autonomous systems can interpret goals, choose actions, and continue without waiting for a person.
Q: What are the signs that an agent governance programme is failing?
A: Common signals include unknown agents in staging or production, unvetted MCP connections, broad or long-lived credentials, and logs that show service-account activity without clear ownership.
Practitioner guidance
- Discover unmanaged agent identities Continuously inventory AI agents and LLM-based workflows before they become shadow identities inside business systems.
- Register agents in IGA from day one Treat each autonomous agent as a managed account with a unique identifier, business owner, defined roles, and explicit lifecycle status.
- Separate delegated access from agent-owned access Classify whether the agent is acting through a user token or through its own credentials, then apply different oversight and revocation rules to each pattern.
Bottom line: Autonomous AI agents expose a governance gap because identity programmes were built for stable humans and predictable machine accounts, not software that can act at runtime on its own.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago 2 times by Abdelrahman
This topic was modified 2 days ago by NHI Mgmt Group
11/10/2026 3:21 am
Autonomous AI agents turn identity governance into a sponsorship problem, not just a provisioning problem. These identities may use delegated user tokens or their own credentials, but either way the organisation still has to know who owns the agent, who approved its scope, and who is accountable when it acts. That pushes IGA from a back-office catalog function into the control plane for software identities.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat AI assistants and autonomous agents the same way?
A: No. AI assistants that act inside a human session can often be governed through delegated access and user accountability, while autonomous agents need their own identity, lifecycle records, and monitoring. Mixing the two creates false comfort and leaves the wrong party accountable for access decisions.
👉 Read our full editorial: Identity management is not ready for autonomous AI agents