Topic starter
14/07/2026 5:24 pm
TL;DR: Identity programmes now have to govern humans and delegated or autonomous agents through the same access, audit, and step-up model, while joining Twilio will extend its identity stack, agent-ready integrations, and fraud controls into a broader communications and data environment, sharpening support for AI agents and context-aware applications, according to Stytch.
Editorial analysis by NHI Mgmt Group, based on content published by Stytch: “Stytch has joined Twilio to build the intelligent identity layer for the internet”.
Key questions
Q: How should security teams scope access for AI coding agents in development workflows?
A: Security teams should treat AI coding agents like any other privileged actor and scope them to the smallest task they need to complete.
Q: Why do delegated agent actions create accountability problems?
A: Delegated agent actions can hide which model chose the path, which policy allowed it, and which tool executed it.
Q: What are the signs that agentic identity controls are not working as intended?
A: Common warning signs include agents accessing systems outside their stated purpose, sharing sensitive data inappropriately, revealing credentials, or leaving gaps in auditability.
Practitioner guidance
- Define separate authorization scopes for agents Map every agent-capable workflow to a distinct scope that is narrower than the human account behind it.
- Add step-up controls for sensitive agent actions Require re-validation when an agent crosses into account recovery, financial, administrative, or data-disclosure actions.
- Bind audit trails to actor, scope, and delegation source Record whether an action came from a human, a delegated agent, or an autonomous agent, and preserve the scope that was in force at execution time.
Bottom line: AI agents are becoming governed identities inside application flows, which shifts the control problem from login friction to authorization scope and auditability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 5:28 pm
Agent identity is now an authorisation problem, not a UI problem: Once applications must recognize both humans and AI agents, the control question shifts from login experience to scope, delegation, and audit. The same identity event can now precede either a human action or a machine action, which means policy has to travel with the actor. Practitioners should treat agent identity as governed access, not a new front end.
A few things that frame the scale:
- Half of companies using generative AI will deploy agentic AI by 2027, according to Deloitte's 2025 Technology Predictions.
A question worth separating out:
Q: What is the difference between human login controls and agent authorization controls?
A: Human login controls prove a person is present, while agent authorization controls determine what a software actor may do after it is already authenticated. For agentic systems, the main design challenge is not simply proving identity, but constraining action, delegation, and escalation within a live workflow.
👉 Read our full editorial: Stytch joins Twilio: what it means for AI agent identity