Notifications
Clear all
Topic starter
14/07/2026 5:24 pm
TL;DR: Identity programmes now have to govern humans and delegated or autonomous agents through the same access, audit, and step-up model, while joining Twilio will extend its identity stack, agent-ready integrations, and fraud controls into a broader communications and data environment, sharpening support for AI agents and context-aware applications, according to Stytch.
NHIMG editorial — based on content published by Stytch: Stytch has joined Twilio to build the intelligent identity layer for the internet
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
Questions worth separating out
Q: How should security teams handle delegated access when AI agents act on behalf of customers?
A: Security teams should treat delegated access as a separate governance layer, not as a normal login session.
Q: Why do local AI agents complicate identity and access management?
A: They can retain legitimate permissions while changing timing, prioritisation, and action sequence outside human presence.
Q: What breaks when scoped tokens are reused across human and agent workflows?
A: Reusing tokens across human and agent workflows destroys attribution, makes audit trails ambiguous, and creates privilege creep in places where the original intent is no longer visible.
Practitioner guidance
- Define separate policy paths for human and agent sessions Classify every incoming identity event by actor type before it reaches access logic.
- Bind agent credentials to task scope and expiry Issue scoped tokens with short duration, explicit resource boundaries, and revocation hooks tied to the task lifecycle.
- Add step-up controls for high-risk delegated actions Require additional verification before payouts, account changes, role changes, or data export when an agent or delegated session attempts them.
What's in the full analysis
Stytch’s full blog post covers the operational detail this post intentionally leaves for the source:
- How the combined identity stack is positioned for AI agents, including scoped tokens and step-up patterns.
- The communications and reputation data inputs used to strengthen fraud and abuse decisions.
- What customers should expect around SDKs, API keys, pricing, and integration continuity.
- How the publisher frames support for Claude Connectors, ChatGPT Apps, and remote MCP servers.
👉 Read Stytch’s blog post on joining Twilio and supporting AI agent identity →
Stytch and Twilio together: what changes for identity teams?
Explore further
14/07/2026 5:28 pm
Stytch’s move signals that identity for AI agents is becoming a first-class governance problem, not a feature request. The important change is not communication scale alone, but the need to authenticate and authorise non-human actors alongside people in the same application journey. That places scoped delegation, audit, and step-up under one identity model rather than separate fraud and IAM workflows, which is now the practitioner baseline.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when a compromised AI agent misuses delegated access?
A: Accountability usually spans the business owner of the workflow, the team that issued or approved the credential, and the vendor if a third-party integration was involved. The critical governance question is not who logged in, but who allowed the delegation chain to exist and remain valid. That chain must be documented before incidents occur.
👉 Read our full editorial: Stytch joins Twilio: what it means for AI agent identity
