Topic starter
22/06/2026 10:08 am
TL;DR: Identity security is extending from credential protection into runtime access governance, with just-in-time access for humans, machines, and AI agents, plus unified audit trails and intent-based controls, according to 1Password. The practical shift is that standing privilege, not just secret storage, becomes the core governance problem when agents and workloads act inside production systems.
Editorial analysis by NHI Mgmt Group, based on content published by 1Password: “1Password Pioneers Access Governance for Humans, Machines, and AI Agents with Acquisition of Apono”.
Key questions
Q: What breaks when access is granted once and never removed for humans, machines and agents?
A: Standing access creates hidden privilege persistence, which means a task can end while the identity still retains the ability to act.
Q: Why do just-in-time controls reduce risk more effectively than pre-provisioned access?
A: Just-in-time controls reduce the time window in which a privileged identity can be misused.
Q: How do security teams know whether agent permissions are still valid?
A: They should look for expiry, logging and revocation tied to the original task.
Practitioner guidance
- Map standing privilege across humans, machines and agents Inventory where access is granted once and left in place, especially across cloud platforms, data systems and developer tools.
- Move approvals to the moment of need Replace pre-provisioned access with just-in-time issuance for time-bound tasks, and ensure revocation is automatic at task completion.
- Bind delegated agent access to declared intent Require agent requests to carry the business purpose they are allowed to execute, then compare that intent to the actions the agent actually takes.
Bottom line: The article frames standing access, not credential storage alone, as the main governance problem for humans, machines and AI agents.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 10:55 am
Standing access is now the core identity governance liability. The article makes the case that the problem is no longer secret storage alone but permissions that persist after the need has passed. That is a governance failure across humans, machines and agents because the control plane keeps authorising access after the business justification disappears. Practitioners should read this as a shift from vault-centric security to runtime privilege containment.
A few things that frame the scale:
- 59% of organisations say they lack viable alternatives to standing privileged access for NHIs and AI agents, according to Delinea research.
A question worth separating out:
Q: What is the difference between credential security and access governance?
A: Credential security protects the secret or token itself, while access governance controls what that identity may actually do once authenticated. The distinction matters because a protected credential can still enable excessive or long-lived access if runtime permissions are not scoped, monitored and revoked. Mature programmes need both layers, not one or the other.
👉 Read our full editorial: 1Password and Apono reset access governance for humans, machines, and agents