Topic starter
14/05/2026 6:58 pm
TL;DR: Static identity controls cannot keep pace with dynamic threats or agentic AI, and governing every user, app, and permission in real time is now central to resilience, attack-surface reduction, and business trust, according to SailPoint. Periodic access administration is giving way to continuous identity governance across human and non-human paths.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Identity Day”.
Key questions
Q: How should security teams govern agentic AI that can execute IAM tasks?
A: Start by treating the agent as an NHI with bounded authority, explicit ownership, and revocation procedures.
Q: Why do static identity controls break down for agentic AI and dynamic access?
A: Static controls assume privileges remain stable long enough to be reviewed and certified.
Practitioner guidance
- Define runtime identity governance thresholds Set explicit conditions for when access, delegation, or privilege changes require immediate reassessment rather than waiting for the next review cycle.
- Inventory AI agents and delegated access paths Map every agentic workflow, the identities it uses, and the permissions it can combine so governance can follow the real execution path.
- Shift review cadence toward continuous entitlement visibility Use live entitlement and activity data to identify when permissions have drifted from approved business need.
Bottom line: Static identity administration is no longer enough when access can change during task execution or through delegated workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
14/05/2026 7:01 pm
Adaptive identity is becoming a necessary control model because static reviews cannot keep pace with runtime access change. Identity programmes were built around the assumption that privileges remain stable long enough to be provisioned, reviewed, and revoked in orderly cycles. Agentic AI and fast-moving digital operations break that assumption by making access contextual and time-sensitive. The implication is that identity governance has to be judged by how quickly it can reflect real access state, not by how cleanly it documents yesterday’s state.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do adaptive identity and zero trust differ in practice for identity teams?
A: Zero Trust defines the continuous verify-before-trust posture, while adaptive identity is the governance mechanism that updates access decisions as context changes. In practice, Zero Trust sets the security expectation and adaptive identity supplies the live identity controls that make that expectation operational for human, non-human, and agentic access.
👉 Read our full editorial: Identity Day frames adaptive identity for agentic AI risk
This post was modified 4 days ago by NHI Mgmt Group