Topic starter
05/10/2026 6:49 pm
TL;DR: Nexis says AI agents and other non-human identities now need the same governance discipline as workforce accounts, as its roadmap adds an Evidence Collector for verifiable documentation, governable dynamic access policies, NICO AI Co-Pilot, and recertification reviews that reviewers actually finish. The core shift is that identity governance is expanding from periodic human review to continuous proof, policy, and oversight for machine actors.
Editorial analysis by NHI Mgmt Group, based on content published by Nexis: “Agents, Evidence, and Dynamic Policies: New and Upcoming NEXIS Features”.
Questions worth separating out
Q: How should security teams recertify AI agent access differently from human access?
A: Use a separate review flow that tracks the agent's business purpose, runtime scope, and evidence trail rather than relying on manager-centric workforce review.
Q: Why does evidence matter so much in non-human identity governance?
A: Evidence turns access decisions into something reviewers and auditors can verify later.
Practitioner guidance
- Map AI agents to a separate governance workflow Define a non-human identity review path for agents that includes ownership, business purpose, evidence, and runtime access scope.
- Require verifiable evidence for every entitlement decision Capture the policy rationale, approver context, and access scope in a form reviewers can inspect later.
- Review dynamic policies as a governance control Validate whether task-scoped or context-sensitive rules still reflect actual agent behaviour after model or workflow changes.
What to expect at the briefing
Nexis's full webinar covers the operational detail this post intentionally leaves for the source:
- Live walkthrough of the Evidence Collector and how it turns governance documentation into verifiable proof
- Feature context for governable dynamic access policies and how they fit into day-to-day IAM operations
- Recertification workflow details aimed at helping reviewers complete reviews instead of abandoning them
- Roadmap context for Bring Your Own LLM and how governance choices change when the model is part of the control plane
👉 Read Nexis's outlook on AI agents, evidence, and dynamic identity governance →
Agents, evidence and dynamic policies: what changes for IAM teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
05/10/2026 6:49 pm
AI agent governance is now an identity discipline, not a feature add-on. The article shows that recertification, evidence, and dynamic policy are converging into one control surface for machine actors. That matters because identity teams cannot govern AI agents by only extending human workflows and hoping the same review logic will hold. Practitioner conclusion: agents need identity governance designed around their runtime behaviour, not a human proxy.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations decide when dynamic access policies are appropriate for AI agents?
A: Use dynamic policy when access needs to follow task scope, runtime context, or changing risk signals, but keep the policy simple enough that governance can still explain and verify each decision. If the rule set cannot be audited, it is too dynamic to govern safely.
👉 Read our full editorial: Agents, evidence and dynamic policies reshape identity governance