Topic starter
12/06/2026 9:45 pm
TL;DR: AI agents are creating a security blind spot because 80% of organisations report agent actions beyond intended scope and only 52% can track the data those agents access, according to SailPoint research. The governance problem is no longer theoretical: access review and compliance models assume access stays stable long enough to observe, but autonomous behaviour collapses that window.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Gartner Security & Risk Management Summit London”.
Key questions
Q: What breaks when AI agent access is reviewed only after the fact?
A: After-the-fact review leaves a gap between action and containment.
Q: Why do AI agents increase non-human identity risk?
A: AI agents increase non-human identity risk because they can execute many actions quickly once they inherit a credential or tool permission.
Practitioner guidance
- Map all AI agent identities and owners Build an inventory that includes sanctioned agents, shadow AI, supporting service accounts, and the teams responsible for each identity lifecycle.
- Shorten privilege approval windows Replace slow certification cycles with issuance-time controls for AI agents where privilege can be created and used before a review occurs.
- Separate agent access from human roles Stop inheriting access from human job roles by default and define agent-specific authorization boundaries for tools, data, and delegated actions.
Bottom line: AI agents expose a timing problem in identity governance because traditional review cycles assume access lasts long enough to be certified.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
13/06/2026 12:04 am
Machine-speed identity has broken the assumption that access remains stable long enough to govern. Identity programmes were built around durable subjects whose privileges could be reviewed after issuance and before renewal. AI agents compress that window so quickly that certification becomes a retrospective record, not a real control. The implication is that identity governance now has to account for runtime behaviour, not just assigned entitlements.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How can organisations govern AI agents that use service accounts and tokens?
A: Treat those credentials as governed non-human identities with lifecycle controls, not as temporary developer conveniences. That means provisioning them with clear scope, monitoring how they are used, rotating them on a schedule, and removing them when the workflow ends. The goal is to keep the agent’s privilege bounded across its entire operating life.
👉 Read our full editorial: AI agent governance is outpacing identity controls at Gartner SRM 2026
This post was modified 5 days ago by NHI Mgmt Group