Topic starter
25/06/2026 1:14 am
TL;DR: AI factories move AI development on-premises or into hybrid data centres, giving organisations more control but also shifting responsibility for access management, auditing, and privileged control onto internal teams, according to Delinea. The critical gap is that high-performance AI environments can amplify unmanaged service identities, shadow AI, and over-privileged access faster than standard IAM processes can keep up.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Secure AI factories with NIST HPC guidelines, NVIDIA architecture, and Delinea controls”.
Key questions
Q: Where do AI factories fail when service accounts and admin rights are not separately governed?
A: They fail when the same identities are allowed to provision workloads, move data, and administer the environment without clear role separation.
Q: Why do AI agents increase identity and data access risk in cloud analytics platforms?
A: AI agents expand risk because they can act autonomously, reach sensitive data, and interact with connected services faster than manual review can keep up.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Define zone-scoped identity boundaries Map access, management, compute, and storage zones to separate roles and entitlements so users and services only reach the zone they actually need.
- Centralise service account lifecycle control Inventory scheduler, data mover, and model-service identities, then assign ownership, provisioning, rotation, and revocation to one authoritative process.
- Separate admin elevation from workload execution Require dedicated administrator accounts for maintenance and block the pattern where privileged users also run AI jobs with root or equivalent rights.
Bottom line: AI factories shift AI risk from cloud provider controls to internal identity governance, especially around service accounts and privileged access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 10:31 am
AI factories expose identity as the primary control surface. Once AI development moves out of managed cloud services and into on-premises or hybrid factories, identity governance stops being a supporting function and becomes the operating model. The environment is too distributed, too fast, and too privilege-heavy for perimeter thinking to carry the load. Practitioners should read this shift as a control reordering: who can act, under what role, and with what audit trail becomes the decisive design question.
A question worth separating out:
Q: What is the difference between zone-based access control and least privilege in AI factories?
A: Zone-based access control decides where an identity is allowed to enter and operate, while least privilege decides how much it can do once inside. In AI factories, both are needed because a user or service account can still be over-entitled even if the zone boundary exists. The practical difference is between limiting reach and limiting power.
👉 Read our full editorial: AI factories expose identity gaps that cloud AI hid