Notifications
Clear all
Topic starter
25/06/2026 5:24 pm
TL;DR: The real issue is not platform breadth but whether identity programmes can govern machine and agent access without collapsing lifecycle, privilege, and accountability controls, according to Saviynt. Saviynt positions its identity cloud around governing human and non-human access across applications, data, and business processes, with specific emphasis on NHI, JIT access, and AI agents.
NHIMG editorial — based on content published by Saviynt: the newsroom overview of its identity cloud, NHI, and AI agent governance
By the numbers:
- Saviynt says its platform protects over 100 million identities.
- Only 5.7% of organisations have full visibility into their service accounts.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
Questions worth separating out
Q: How should security teams govern human and non-human access in one programme?
A: They should use one governance model for policy, evidence, and lifecycle, but separate control patterns for each actor type.
Q: When does just-in-time access create more risk than it reduces?
A: JIT becomes risky when the organisation cannot prove who requested access, what scope was granted, and whether revocation actually happened.
Q: What do security teams get wrong about non-human identity governance?
A: They often treat service accounts and tokens as static technical assets instead of governed identities with owners, lifecycle events, and offboarding requirements.
Practitioner guidance
- Inventory non-human identities by control owner Create a single inventory for service accounts, API keys, tokens, certificates, and AI agent credentials, then assign a named control owner for each identity so revocation and review do not depend on informal knowledge.
- Separate JIT workflows by actor type Use different approval, scope, and revocation logic for human privileged sessions, workload identities, and AI agent access so that task-scoped access is not forced into one generic workflow.
- Tie agent access to explicit runtime boundaries Define which tools, data sources, and execution paths an AI agent may use, and block expansion beyond those boundaries unless a new approval is issued.
What's in the full article
Saviynt's full newsroom page covers the platform details this post intentionally leaves at the governance level:
- How Saviynt positions its identity cloud across human identity, NHI, PAM, and application access governance.
- The specific product areas tied to NHI, just-in-time access, and AI agents that are only sketched here.
- The broader platform catalogue and solution mapping that implementation teams may want to review after the strategic read.
- The company’s own framing of where these capabilities fit in its product and market narrative.
👉 Read Saviynt’s newsroom overview of identity cloud, NHI, and AI agent governance →
Saviynt identity cloud: what changes for NHI and AI agent governance?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 6:03 pm
Identity security is becoming a control-plane problem, not a point-solution problem. Saviynt’s page reflects a market where human IAM, NHI governance, JIT access, and AI agent access are converging into the same operational surface. That convergence is useful only if policy, lifecycle, and evidence collection are aligned across actor types. The practitioner takeaway is that control fragmentation now creates governance failure faster than missing a single feature.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who should be accountable for AI agent access decisions?
A: Accountability should sit with the business or technical owner that authorises the agent’s operating boundary, not with the agent itself. If an agent can initiate actions and select tools at runtime, the organisation needs a named human owner for policy, escalation, and exception handling.
👉 Read our full editorial: Saviynt’s identity cloud and what it means for NHI governance
