Topic starter
11/08/2026 3:15 pm
TL;DR: AI agents expose the limits of governance models built only for human joiner-mover-leaver patterns, because they can inherit permissions, use tools, and act without waiting for quarterly review cycles, according to Fischer Identity. The governance gap is not IGA itself but whether ownership, lifecycle, certification, and auditability can extend to every non-human identity.
Editorial analysis by NHI Mgmt Group, based on content published by Fischer Identity: “AI Agents Do Not Make IGA Obsolete. They Make Modern Identity Governance More Important.”.
Key questions
Q: How should teams govern AI agents that inherit human access rights?
A: Teams should treat inherited access as temporary and bounded to a specific task, owner, and expiry.
Q: What breaks when autonomous AI agents are governed with quarterly review cycles?
A: Quarterly review cycles assume risk is stable long enough to observe, document, and certify.
Q: Why do AI agent workflows need identity governance for oversight?
A: Because oversight only works when the organisation can prove who approved an action, what they saw, and why they intervened.
Practitioner guidance
- Define AI agent ownership records Assign each agent a named business owner, sponsoring function, and accountable human approver before it receives production access.
- Extend lifecycle controls to non-human identities Track creation, approval, expiration, suspension, renewal, and deprovisioning for agents in the same governance system used for other identities.
- Link certification to runtime evidence Use certification to verify purpose and approval, then correlate it with logs from the systems where the agent acted.
Bottom line: AI agents expose the limits of identity programmes that still assume human lifecycle patterns are the default governance model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/08/2026 3:28 pm
AI agents expose a governance assumption collapse, not a category failure. Traditional IGA assumes the governed identity is stable enough to be onboarded, reviewed, and offboarded through a human-centric lifecycle. That assumption fails when an agent can be created inside an application, inherit access dynamically, and act outside HR-driven processes. The implication is not to abandon governance, but to recognise that the old review model no longer matches the identity behaviour being governed.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams govern AI agents before they start blocking actions?
A: They should begin with observation-only controls, capture action-level telemetry, and build a baseline of normal behaviour before enforcing deny rules. That sequence reduces false positives and prevents policy from being written against assumptions instead of evidence. Once the baseline is stable, teams can harden policy around observed workflows rather than generic templates.
👉 Read our full editorial: AI agents strengthen the case for modern identity governance