Topic starter
06/11/2026 6:55 pm
TL;DR: AI agents turn machine identity into a runtime governance problem, according to AppViewX's analysis of agentic systems. Practitioners need continuous authorization and behavioural controls because authentication alone cannot govern what an agent does after it connects.
Editorial analysis by NHI Mgmt Group, based on content published by AppViewX: “Agentic AI Identity Security: Interview with AppViewX’s CTO”.
By the numbers:
- AI agents will appear in 33% of enterprise software applications by 2028, up from less than 1% in 2024, according to Gartner research cited by AppViewX.
- Machine identities outnumber humans 82:1 in today’s enterprise environments, according to AppViewX.
Key questions
Q: Why is certificate validation not enough for agentic systems?
A: Certificate validation only proves a presented certificate is trusted and current.
Q: How should teams govern runtime access for machine identities?
A: Teams should govern runtime access with just-in-time permissioning, explicit ownership, and short-lived credentials tied to each machine identity.
Q: Why do AI agents change infrastructure identity governance?
A: AI agents change the model because they can take actions, call tools, and operate without a human approving each step.
Practitioner guidance
- Implement continuous discovery for agent identities Maintain an always-current inventory of agents, their certificates, owners, and system reach so newly deployed identities are visible before they accumulate broad access.
- Separate authentication from action approval Use runtime policy checks for each agent action so certificate validity never functions as blanket permission across sensitive workflows.
- Right-size entitlements against observed behaviour Compare granted permissions with actual agent activity and reduce access where the task only needs narrow, time-bound scope.
Bottom line: AI agents expose a structural weakness in machine identity programmes because authentication alone cannot govern action.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
AI agents turn machine identity into a behavior problem, not just a scale problem. Static certificate operations were built for predictable workloads that could be issued, rotated, and revoked on schedule. AI agents act differently because they can adapt, chain actions, and continue operating after authentication. The consequence is that identity governance has to move from managing records to governing runtime decisions.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What happens when agents are deployed faster than identity reviews?
A: When agents are deployed faster than identity reviews, stale service accounts, tokens, and secrets accumulate with no clear owner or scope. That creates standing access, weak offboarding, and blind spots in access reviews, so the agent can keep using privileges long after the intended task, team, or control has changed.
👉 Read our full editorial: AI agents turn machine identity into a runtime governance problem