Topic starter
19/12/2025 11:39 am
TL;DR: AI agent adoption is already widespread, with 91% of organisations using agents while only 10% have a well-developed governance strategy and nearly half lack any formal framework, according to Okta and The Times. The gap is no longer theoretical because identity, authorization, and lifecycle controls were not designed for autonomous software acting at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Okta: “From Code to Control: The Blueprint for Securing AI Agents at Enterprise Scale”.
By the numbers:
- 91% of organisations are already utilizing AI agents according to the 2025 Okta at Work report.
- Only 10% have a well-developed strategy for managing these non-human identities.
Key questions
Q: What breaks when AI agents inherit human IAM controls?
A: Human IAM controls break because they assume a person makes a request, waits, and can later be reviewed or deprovisioned.
A: Over-privileged AI systems expand blast radius because they can move faster, touch more systems, and make repetitive mistakes at scale.
Q: How do teams know whether AI governance is actually working?
A: Look for evidence that every AI interaction can be traced end to end, from identity and intent to output and enforcement.
Practitioner guidance
- Inventory every AI agent as a governed identity Build a registry that assigns ownership, purpose, and lifecycle state to each agent, including unmanaged shadow AI discovered across SaaS and cloud platforms.
- Replace long-lived secrets with managed token lifecycles Remove hard-coded API keys and long-lived tokens from agent code and configuration, and move them into controlled issuance and rotation workflows.
- Narrow authorization to task and data scope Move away from application-level grants and enforce document-level or relationship-based access so agents only reach the data required for each workflow.
Bottom line: AI agents expose a mismatch between legacy IAM assumptions and machine-speed identity behaviour, especially where continuous execution and chained actions are involved.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
08/10/2026 5:30 pm
Legacy IAM assumes access is human-paced, and that assumption is already failing. Traditional identity programmes were designed around login events, session boundaries, and an operator who can be reviewed after the fact. AI agents can act continuously and trigger multiple system calls inside a single goal-directed workflow, which means the control point shifts from session management to identity governance at issuance time. The practical conclusion is that human-session logic cannot be the default model for agent governance.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations use the same access model for humans and AI agents?
A: No. Human access models are built around stable roles and review cycles, while AI agents often need contextual, task-specific permissions that change quickly. Treating them the same usually leads to over-permissioning or constant exceptions. Organisations should separate identity proof from authorization design and apply resource-level controls for agents.
👉 Read our full editorial: AI agent governance is outpacing legacy IAM controls