Topic starter
09/02/2026 1:49 pm
TL;DR: Gartner’s Time to Trust frames trust as a measurable reduction in human-in-the-loop oversight, and Delinea applies that idea to identity, access, and governance where autonomy is actually enforced. The real issue is that many identity programmes still assume access decisions can be reviewed after the fact, even when agentic systems act within a single session.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “From human approval to governed autonomy: Applying Gartner's Time to Trust to identity”.
Key questions
Q: How should security teams decide when to reduce human oversight for agentic AI?
A: Security teams should tie oversight reduction to a documented threshold for risk, repeatability, and explainability.
Q: Why do human-in-the-loop controls reduce risk in high-stakes AI decisions?
A: Human-in-the-loop controls reduce risk because AI can be fast and consistent, but it may miss context, nuance, or ethical implications.
Q: What breaks when agentic AI can act outside clear identity boundaries?
A: Accountability breaks first, followed by auditability and revocation.
Practitioner guidance
- Define trust thresholds for each workflow Set explicit human-in-the-loop reduction criteria by use case, risk level, and authorisation point so autonomy is granted only when the evidence is sufficient.
- Instrument approval and rollback points Record when oversight is removed, who approved the change, and how the decision can be reversed if risk changes or the workflow misbehaves.
- Map agentic workflows to identity boundaries Identify where new AI-driven actions inherit privileges, where they must be isolated, and where entitlements should never expand beyond the original request.
Bottom line: Agentic AI governance becomes tractable when trust is treated as a measurable control condition rather than a subjective belief.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/10/2026 2:57 am
Time to Trust is an identity governance model, not an AI confidence score. The useful question is whether a system can move from human-reviewed action to governed autonomy without losing auditability or reversibility. That makes authorisation design the core control plane for agentic AI, because the trust decision is enforced there, not in policy slides. Practitioners should treat the threshold itself as a governed artefact.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do organisations know if autonomous governance is actually working?
A: Look for shorter decision cycles, fewer stale entitlements, and an audit trail that records every grant, revoke, and exception in real time. If the programme still relies on quarterly cleanup to find obvious drift, it is not autonomous governance. It is still manual governance with faster tooling.
👉 Read our full editorial: Time to Trust in identity: what governed autonomy changes