Topic starter
22/02/2026 9:47 pm
TL;DR: Agentic AI systems can interpret objectives, request more access, and act across apps at machine speed, making periodic access reviews and static IGA controls too slow for the risk, according to Omada Identity. The governance problem is that review cycles assume access remains stable long enough to certify, while autonomous agents can expand privilege and impact within the same operational window.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “Why Agentic AI Demands a New Approach to Identity Security Governance”.
Key questions
Q: What breaks when access review models are applied to agentic AI?
A: Access review models break when the actor can obtain, use, and release privileges before the review cycle sees a stable state.
Q: Why do adaptive agents create more governance risk than ordinary automation?
A: Because they can change their next step based on feedback, context, and prior memory.
Q: How should security teams limit agent access to sensitive data?
A: Start by limiting inheritance.
Practitioner guidance
- Inventory every agentic identity Record business function, owner, integrations, privilege level, and retirement state for each agent so governance teams can see the full population, not just the visible ones.
- Replace static certification with continuous entitlement monitoring Track when agents request, gain, or shed permissions and compare live behaviour against the approved task scope instead of relying on annual access review snapshots.
- Enforce time-bound least privilege for agent tasks Issue only the minimum access needed for the current objective and expire it automatically when the use case, project, or workflow stage ends.
Bottom line: Agentic AI creates a governance problem because it can request access, act, and adapt faster than periodic reviews can track.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/10/2026 2:59 am
Periodic certification is the wrong control plane for autonomous identity behaviour: annual or scheduled review assumes access remains stable long enough to be observed, challenged, and certified. Agentic AI breaks that premise because it can acquire, use, and reshape privilege inside the same operational window. The implication is not merely that reviews need to happen faster, but that governance has to move from retrospective validation to continuous runtime control.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do organisations know if agent governance is actually working?
A: Agent governance is working when every agent is discoverable, owned, least privileged, and auditable at the action level. Look for reduced shadow AI, fewer embedded secrets, clean revocation on retirement, and logs that show which tools and data paths were used. If those signals are missing, governance is still partial.
👉 Read our full editorial: Agentic AI demands continuous identity governance, not periodic review