Topic starter
20/01/2026 12:55 pm
TL;DR: Non-human identities now outnumber human identities 20 to 1, and Descope argues that agentic adoption depends on finer-grained identity, interoperable protocols, and short-lived access models as AI agents begin acting across apps, APIs, and tools. The governance challenge is that existing IAM assumptions were built for service accounts and human-paced approval loops, not cascading agent behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “Identity Infrastructure for the Agentic Age”.
By the numbers:
- Non-human identities outnumber human identities 20 to 1.
Key questions
A: Security teams should treat agent permissions as ephemeral and context bound, not permanent entitlements.
Q: Why do coarse roles break down when AI agents act across multiple tools?
A: Because a single agent task can span several systems, actions, and trust boundaries in one session.
Q: What are the biggest governance mistakes teams make with agentic identity?
A: The most common mistakes are assuming the agent can inherit human-style access, letting tokens live too long, and treating integration plumbing as separate from security.
Practitioner guidance
- Define task-bounded scopes Map every agent workflow to the minimum set of API scopes and data actions required for that task, then reject broad reusable entitlements.
- Shorten credential lifetime Use short-lived tokens and task-specific grants so access expires when the agent finishes the work, not after a fixed human-style session.
- Standardise agent auth flows Adopt OAuth, MCP, JWTs, and OpenAPI as the common identity and integration layer so each new tool does not require a custom trust pattern.
Bottom line: Agentic identity changes the control problem from static account management to delegated, task-bounded authority across tools and APIs.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 7:23 pm
Agentic identity is where legacy IAM assumptions start to fail: access reviews, coarse roles, and approval loops were designed for identities whose access persists long enough to be observed and certified. That assumption weakens when an agent can request, use, and discard access inside a single task. The practitioner conclusion is that authorisation has to move closer to issuance time, not rely on later review cycles.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How can IAM teams tell whether agent access is actually under control?
A: IAM teams should look for per-action authorization, complete audit trails, separate ownership, and fast revocation of agent privileges. If an agent can make sensitive tool calls without a logged decision point, control is weak. If the answer to who approved each action is unclear, the programme is not yet governable.
👉 Read our full editorial: Identity infrastructure for the agentic age needs finer-grained controls