Topic starter
24/12/2025 9:49 am
TL;DR: AI agents are already in use at 91% of organizations, yet only 10% have a well-developed management strategy and nearly half lack formal governance, according to Okta and The Times. The governance gap is now an identity risk, because autonomous agents operate continuously with permissions and data access that legacy IAM was not built to constrain.
Editorial analysis by NHI Mgmt Group, based on content published by Okta: “From Code to Control: The Blueprint for Securing AI Agents at Enterprise Scale”.
By the numbers:
- 91% of organisations are already utilizing AI agents.
- Only 10% have a well-developed strategy for managing these non-human identities.
- 91% of organisations are already utilizing AI agents while only 10% have a well-developed strategy for managing them.
Key questions
Q: How should security teams govern AI agents when autonomy expands faster than oversight?
A: Security teams should treat agent governance as an identity and access problem, not just an AI operations issue.
Q: Why do long-lived API keys create more risk for AI agents?
A: Long-lived API keys increase risk because they persist across tasks, deployments, and runtime changes.
Q: What breaks when AI agents inherit access from users and service accounts?
A: The main failure is that inherited access can be broader than the agent’s actual task, so privilege becomes easier to reuse than to govern.
Practitioner guidance
- Inventory shadow AI identities Discover unmanaged agents across cloud and SaaS estates, then assign ownership, business purpose, and lifecycle status before they remain active in production.
- Eliminate standing secret exposure Move API keys, service account credentials, and OAuth tokens out of code and configuration into managed vault workflows with automated rotation and revocation.
- Reduce over-provisioned agent scope Issue role templates that are narrowly bounded to the task, then continuously review whether the agent still needs the same entitlement set across systems.
Bottom line: AI agent adoption is already mainstream, but governance maturity is still lagging, which creates a direct identity security gap.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago by Abdelrahman
This topic was modified 5 days ago by NHI Mgmt Group
08/10/2026 5:30 pm
AI agent governance is now an identity discipline, not an AI add-on. Okta’s central finding is that deployment has already normalised AI agents faster than governance structures can absorb them. That means the primary control question is no longer whether an agent can do the task, but whether the organisation can bind that task to a managed identity with ownership, scope, and lifecycle. The implication is that identity programmes must treat agents as first-class subjects of governance, not as extensions of application automation.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do security teams respond when an AI agent needs to be contained quickly?
A: Containment should include pausing the agent and removing the access it can exercise, not just turning off execution. If permissions remain active, the investigation is still exposed to the same risk. A practical response plan needs quarantine, deprovisioning, and an investigation path that preserves evidence.
👉 Read our full editorial: AI agent identity governance is lagging enterprise adoption