Notifications
Clear all
Topic starter
20/08/2026 11:37 am
TL;DR: Privileged identity has moved from a vault-era model to hybrid sprawl and now to an agentic era, where standing roles, quarterly reviews, and off-path controls cannot keep pace with machine-speed authentication and delegation, according to Venice.io. The core assumption is collapsing: access can no longer be provisioned long enough to review before it is already used and gone.
NHIMG editorial — based on content published by Venice.io: Zero Standing Privileges and the shift in privileged identity
Questions worth separating out
Q: What breaks when organisations keep standing privilege for AI agents and NHIs?
A: Standing privilege turns into unmanaged exposure when access outlives the task that justified it.
Q: Why do quarterly access reviews fall short for machine identities and AI agents?
A: Quarterly reviews assume access is stable long enough to be observed and certified.
Q: How should security teams govern privileged access in cloud and hybrid environments?
A: Teams should govern privileged access around runtime authorization, not just connectivity or login.
Practitioner guidance
- Inventory privileged access outside the vault Identify cloud roles, OAuth apps, CI/CD identities, and third-party access paths that never enter the central vault.
- Remove standing privilege from high-risk paths Prioritise administrator roles, service accounts, and agent execution paths that can operate without a current task.
- Shift reviews from periodic to runtime Use context-aware authorization checks for elevated actions so approval is tied to the request, not the calendar.
What's in the full article
Venice.io's full blog post covers the architectural argument this post intentionally leaves at a higher level:
- The full progression from vault era to hybrid sprawl to agentic execution
- Uriel Zilberberg's framing of why standing roles persist in enterprise workflows
- The operational meaning of Zero Standing Privilege when access must be created and revoked at runtime
- The vendor's view of how the next category of privileged identity tooling will differ from vault-centric models
👉 Read Venice.io's analysis of Zero Standing Privilege and the agentic era →
Zero standing privilege and AI agents: what changes for IAM teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
20/08/2026 11:37 am
Standing privilege is the wrong default for both NHI and agentic identity. The article is right to frame the transition as architectural, not cosmetic. Once workloads, service accounts, and AI agents can execute at machine speed, persistent privilege becomes exposure time, not convenience. That is why the old habit of cloning roles and leaving them in place now creates governance debt across the whole identity stack.
A few things that frame the scale:
- 88% of security professionals are concerned about secrets sprawl, with 49% of those in larger organisations described as "very concerned," according to the 2024 State of Secrets Management Survey.
- 62% of all secrets are duplicated and stored in multiple locations, which increases the chance that privileged access will be missed or mis-governed.
A question worth separating out:
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.
👉 Read our full editorial: Zero standing privilege is colliding with the agentic era
