Topic starter
22/01/2026 4:48 pm
TL;DR: Enterprises are adding AI agents and cloud apps faster than legacy IGA can govern them, expanding the attack surface and audit burden under GDPR, NIS2 and DORA, according to Omada Identity. The core issue is that access review and lifecycle processes assume identities are stable enough to be reviewed, but AI-driven execution makes that assumption fragile.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “Non-Human Identity Management: Identity Governance for AI Agents”.
By the numbers:
- 72% of CIO participants noted that app sprawl was concerning.
Key questions
Q: How should teams govern non-human identities in AI-heavy environments?
A: Teams should govern non-human identities the same way they govern other privileged assets: assign ownership, minimise scope, rotate credentials regularly, and monitor for abnormal use.
Q: Why do AI agents make legacy IGA harder to operate?
A: AI agents increase the number of identities, the pace of change and the number of systems that must be reviewed.
Q: What are the signs that non-human identity governance is starting to slip?
A: Warning signs include reliance on manual upgrade paths, ad hoc secret handling, and fragmented access management across tools and environments.
Practitioner guidance
- Map AI agents as governed non-human identities Inventory which agents, bots, service accounts and application keys already hold production access, then assign each one an owner, business purpose and lifecycle status.
- Tighten role scope around agent tasks Break broad application access into task-specific roles so each agent only reaches the data and systems needed for its function.
- Automate recertification for machine access Move recurring access reviews for non-human identities into automated workflows that can validate role, purpose and entitlement changes at scale.
Bottom line: AI agents and cloud apps are turning non-human identity governance into a core IGA problem rather than a niche machine-account issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
11/10/2026 3:31 am
AI agent governance is becoming the test case for whether legacy IGA can survive non-human scale. The article is right to frame AI agents and cloud apps as a governance problem, not just an automation trend. Once agents are allowed to hold and use access across systems, the old assumption that identity review is tied to stable human employment cycles stops holding. The implication is that IGA programmes now have to govern execution-bearing identities, not just users.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: When should organisations prioritise automation over manual review for NHI governance?
A: Automation should be prioritised when access volume, agent activity or application sprawl makes manual review too slow to be reliable. If a non-human identity can change state faster than the review cycle can observe it, the control belongs in issuance and monitoring rather than in the spreadsheet.
👉 Read our full editorial: Non-human identity governance for AI agents and legacy IGA