Topic starter
10/06/2026 10:58 pm
TL;DR: Session-based authorization breaks down for agents and ephemeral workloads because permissions assigned at login are too coarse for action-by-action decisions, according to Cerbos’s EIC 2026 panel recap. The real shift is toward real-time, signal-driven authorization with policy-as-code, federated decisioning, and auditable context at each hop, not broader tokens or quarterly reviews.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “EIC 2026 takeaways: the identity stack built for humans will not hold up for AI agents”.
Key questions
Q: How should security teams govern access for agents and ephemeral workloads?
A: They should stop treating login-time grants as the primary control and move to runtime authorization tied to the exact action being attempted.
Q: Why do live signals matter in authorization decisions?
A: Live signals matter because risk, location, device state, and lifecycle events can change after login, and those changes should affect whether an action is allowed.
Q: When does delegated access create more risk than it reduces?
A: Delegated access becomes riskier when access is broad, hard to revoke, or poorly audited.
Practitioner guidance
- Map authorization to action, not session Inventory which systems still rely on login-time roles or bearer tokens for decisions that should be made at the moment of the action.
- Separate policy from application code Move permission logic into a versioned policy engine that can evaluate identity, resource, action, and live signals independently of the app.
- Treat delegation as its own authority path Document when an agent is allowed to act with broader or different access than the commissioning user, especially across regions, data residency boundaries, or third-party trust domains.
Bottom line: Session-based authorization does not fit actors whose scope changes per task, per hop, or per trust domain.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
12/06/2026 4:44 am
Session-based authorization is already misaligned with how agents and ephemeral workloads behave. The old model assumes identities sit still long enough for login-time permissions to remain valid across a session. That assumption fails when the actor changes scope task by task, or appears only long enough to complete one action. The implication is that authorization governance has to move from session review to runtime decisioning.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams decide whether to use policy-as-code for authorization?
A: Policy-as-code is the right choice when authorisation decisions must be consistent, auditable, and reusable across multiple applications or identity types. It becomes especially important when the logic must react to signals at runtime instead of being embedded in code. If you need the same rule to govern humans, workloads, and agents, policy-as-code is the cleanest control plane.
👉 Read our full editorial: Signal-driven authorization is replacing session-based identity models
This post was modified 6 days ago by NHI Mgmt Group