Topic starter
10/06/2026 11:06 pm
TL;DR: 91% of surveyed organisations are already using AI agents, underscoring how access tooling is being pulled into AI workflow governance, according to 1Password and Okta; Okta’s 2026 Businesses at Work report shows 1Password grew 370% year over year in technology. The real issue is not adoption alone, but that existing identity models were built for stable users and struggle with shadow AI, over-privileged agents, and weak auditability.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “1Password shows 370% YoY growth in Okta research report”.
By the numbers:
- 91% of the organisations surveyed are using AI agents, according to 1Password and Okta.
- 1Password showed a 370% year-over-year increase in the technology sector, according to 1Password and Okta.
Key questions
Q: What breaks when AI agents inherit human IAM controls?
A: Human IAM controls break because they assume a person makes a request, waits, and can later be reviewed or deprovisioned.
Q: Why do unknown AI agents create a higher identity risk than approved ones?
A: Unknown agents bypass the normal lifecycle steps that make access governable, including approval, recertification, and offboarding.
Q: What are the signs that an AI identity is failing governance even if access looks limited?
A: An AI identity is failing governance when teams cannot name an owner, explain why it exists, or trace what it did.
Practitioner guidance
- Define agent identity boundaries Assign each AI agent a distinct identity, ownership path, and permitted tool set before it is used in production workflows.
- Review shadow AI as access sprawl Inventory unsanctioned AI tools that can access data, tokens, or downstream systems, then classify them by the permissions they can reach.
- Separate agent actions from user actions Log agent-issued commands, delegated credentials, and downstream system calls independently so investigations can reconstruct who or what acted.
Bottom line: AI agents force identity teams to govern runtime behaviour, not just named users and static roles.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 4:54 am
AI agent adoption is forcing IAM to become runtime governance. Once an identity can select tools, operate across systems, and act without a person in the loop, the control problem changes from user administration to execution governance. That shift matters because the old model assumed identity assignment happened before action, not during it. Practitioners should treat agent access as an operational control surface, not a static account record.
A question worth separating out:
Q: Should IAM teams treat AI as a separate identity domain?
A: No. IAM teams should treat AI as a trigger to reassess existing identity domains, especially NHI, PAM, and access lifecycle management. The underlying controls still apply, but AI changes how quickly decisions happen and how delegation is expressed. The right response is to adapt governance models, not build a disconnected exception path.
👉 Read our full editorial: AI agent adoption is reshaping enterprise identity controls
This post was modified 1 day ago by NHI Mgmt Group