Topic starter
26/01/2026 12:00 pm
TL;DR: Opal Security finds AI agent adoption is expected to jump 327% over the next two years as enterprise identity models strain under agents that reason, adapt, and act at machine speed. Static privilege, predictable lifecycles, and human-paced approval loops no longer describe how access is actually used.
Editorial analysis by NHI Mgmt Group, based on content published by Opal Security: “Securing the Agentic Enterprise: Identity in the Age of Autonomy”.
By the numbers:
- AI agent adoption is expected to jump 327% over the next two years.
Key questions
Q: Why do existing IAM models struggle with AI agent identity?
A: Existing IAM models struggle because they assume a human is directly present to approve access, understand the risk, and carry the accountability.
Q: Why do AI agents make non-human identity governance harder?
A: AI agents make governance harder because they can request tools, act autonomously, and change behaviour across sessions while still relying on machine credentials.
Q: What are the signs that administrative access to an agent platform is too broad?
A: The clearest warning sign is when everyone can build, execute, and administer everything.
Practitioner guidance
- Inventory agent identities separately from human and service accounts Classify which identities behave as agents, which act on behalf of users, and which are ordinary machine identities so delegation does not disappear into a generic asset list.
- Map delegation chains for every agent workflow Record where an agent receives authority, which downstream systems it can reach, and whether another identity can act on its behalf.
- Replace standing access with task-scoped access grants Limit agent privileges to the immediate task window and remove assumptions that the same access should persist across multiple actions or sessions.
Bottom line: AI agent identity exposes a structural gap in IAM because autonomous behaviour breaks the assumptions behind static privilege and human-paced approvals.
What's in the full article
Opal Security's full analysis covers the operational detail this post intentionally leaves for the source:
- The article's breakdown of human, service, machine, and agent identity differences in one operating model
- Examples of delegation-chain tracking and why chain-of-authority verification matters for multi-agent environments
- The platform-oriented view of contextual identity intelligence, behavioural posture, and unified signals across identity classes
- The practical adoption guidance for organisations trying to move from identity inventory to identity intelligence
👉 Read Opal Security's analysis of identity security for AI agents →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
07/10/2026 7:52 pm
AI agent identity is now a governance problem, not just an inventory problem. The article is right to separate agents from conventional service accounts because their behaviour can change within a task, not only at joiner-mover-leaver events. That means entitlement review alone is too slow and too static to explain risk. Practitioners should treat agent identity as runtime governance, not catalogue management.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How can organizations effectively manage access delegation for AI agents?
A: Organizations can manage access delegation for AI agents by implementing policy-based authorization frameworks that ensure correct access levels are maintained. This also involves continuously monitoring agent activities to prevent overprivileged actions.
👉 Read our full editorial: Identity security for AI agents is outgrowing legacy IAM models