Topic starter
18/02/2026 3:13 pm
TL;DR: Teleport's analysis of its 2026 Infrastructure Identity Survey finds agentic AI is widening a governance gap in infrastructure. Identity controls built for human-paced review need tighter scope, attribution and audit rules before broader production use increases exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Teleport: “2026 Research: The Top AI Infrastructure Risks and Identity Gaps”.
By the numbers:
- 79% of organisations are evaluating or deploying agentic AI.
Key questions
Q: Why do static credentials create more risk for AI agents than for traditional workloads?
A: AI agents execute quickly, can chain actions across systems and may terminate before manual review ever happens.
Q: How do you know if AI access controls are actually working?
A: They are working only if you can answer three questions consistently: which identity accessed the system, which data it touched, and whether that access matched the intended business use.
Q: What breaks when AI agents are given broad standing access?
A: Broad standing access breaks governance because the agent can move from one task to another without a fresh authorization check.
Practitioner guidance
- Reclassify AI systems as governed identities Map every production-capable AI workflow to an identity owner, privilege scope, and review path so it is governed like any other actor that can change infrastructure.
- Replace static secrets with short-lived access Reduce passwords, shared secrets, and long-lived tokens for AI systems by issuing short-lived, task-scoped credentials wherever the workflow allows.
- Tighten least-privilege boundaries for agentic workflows Review whether AI systems have broader access than the human role they assist, then narrow the tool and resource scope to the minimum required for each task.
Bottom line: Agentic AI in infrastructure is exposing a governance gap between machine-paced action and human-paced identity controls.
Glossary terms: Agentic AI Identity, Access Attribution, Static Credential, Privilege Scope
What's in the full report
Teleport's full report covers the operational detail this post intentionally leaves for the source:
- Industry-by-industry incident-rate breakdowns for AI-enabled infrastructure
- Survey methodology and leader sentiment data behind the preparedness findings
- Practical guidance on secretless authentication and short-lived credentials
- Teleport's full discussion of its Agentic Identity Framework and related access patterns
👉 Read Teleport's full report on AI infrastructure identity gaps →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
07/10/2026 6:00 pm
Identity governance for AI fails when access is treated as a convenience layer rather than a first-class actor control. Teleport's findings show that organisations are promoting AI into infrastructure faster than they are redesigning the identity model around it. The result is not just more automation, but more unowned access paths, weaker attribution, and privilege granted before governance has caught up. Practitioners should treat AI as an identity problem before they treat it as an operational efficiency problem.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations treat AI agents as NHI or as application automation?
A: They should treat them as governed non-human identities with application behaviour. That framing captures the need for identity, scope, lifecycle, and audit controls while still recognising that agents operate through APIs, tools, and workflows. Pure automation language hides the governance gap.
👉 Read our full editorial: AI agent adoption is widening identity gaps in infrastructure