Notifications
Clear all
Topic starter
10/06/2026 11:15 pm
TL;DR: Enterprise security programs still assume identity is established at a gate, access is reviewed on a schedule, and policy can be written once, but modern NHI and agentic AI environments now require continuous, context-aware authorization, according to EnforceAuth. The structural failure is no longer credentialing alone; it is the broken assumption that static IAM can govern runtime decisions.
NHIMG editorial — based on content published by EnforceAuth: The Authorization Gap and the future of enterprise identity
By the numbers:
- Non-human identities now outnumber human identities by a wide and accelerating margin, commonly cited industry figures range from 45:1 to 92:1 with a weighted enterprise average around 82:1.
Questions worth separating out
Q: How should security teams govern authorization for NHI and AI agent requests?
A: Security teams should govern NHI and AI agent requests with per-request authorization, not only lifecycle reviews or static roles.
Q: Why do non-human identities create more authorization risk than human accounts?
A: Non-human identities create more authorization risk because they operate at machine speed, appear and disappear continuously, and often carry permissions that outlive the original task.
Q: What breaks when access reviews are used as the main control for NHI governance?
A: Access reviews break down when they are treated as the primary control for NHI governance because they happen too slowly and see only snapshots.
Practitioner guidance
- Map authorization surfaces end to end Inventory where access decisions are made today across IdP, cloud IAM, Kubernetes, databases, application logic, and tool-call gateways.
- Enforce per-request policy checks for non-human actors Require every workload, service account, and agent request to pass through a decision point that uses live context, not only stored entitlements.
- Separate enforcement from application code Move the allow or deny decision into a dedicated PEP and keep policy versioned, testable, and observable.
What's in the full report
EnforceAuth's full paper covers the architectural detail this post intentionally leaves at the control-plane level:
- The PDP and PEP reference architecture with evaluation flow, decision logging, and enforcement separation.
- Open Policy Agent and Rego design patterns for runtime authorization across APIs, databases, and agent tool calls.
- A migration path from legacy IAM and access reviews to continuous authorization with live context.
- The evaluation checklist for buying or building authorization infrastructure at enterprise scale.
👉 Read EnforceAuth's analysis of the authorization gap in enterprise IAM →
Authorization gap in enterprise IAM: what are teams missing?
Explore further
12/06/2026 5:08 am
The authorization gap is a structural defect, not a tuning problem. Authentication-centric IAM was built for rare, human-paced access decisions, while the modern enterprise now runs on continuous machine and agent decisions. That mismatch means the issue is architectural, not procedural. Policy written for quarterly review cannot govern thousand-decision-per-minute execution. Practitioners should treat authorization as a first-class runtime control plane, not an afterthought.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which means most teams still lack a reliable view of NHI ownership and exposure, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between authentication and authorization in modern IAM?
A: Authentication proves the subject is known. Authorization determines whether that subject may perform a specific action, on a specific resource, in a specific context, right now. Modern IAM fails when these are conflated, because a valid identity does not automatically mean a valid action. Continuous authorization is the missing control.
👉 Read our full editorial: The authorization gap is widening across NHI and agentic AI
