Topic starter
08/04/2026 2:58 pm
TL;DR: AI adoption is pushing 90% of organisations to loosen identity controls, even as 80% say they cannot always explain why an NHI performed a privileged action and 59% lack alternatives to standing access, according to Delinea research. The governance problem is no longer visibility in the abstract; it is whether identity programmes can keep pace with AI-driven privilege use without weakening control boundaries.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Delinea Report Finds 90% of Organizations Pressure Security Teams to Loosen Identity Controls for AI”.
By the numbers:
- 90% of organizations pressure security teams to loosen identity controls to enable AI initiatives.
- 80% of organizations say they are unable to always understand why an NHI performed a privileged action.
- 59% of organizations report lacking viable alternatives to standing privileged access for NHIs and AI agents.
Key questions
Q: What happens when organisations loosen identity controls for AI before governance is ready?
A: They create a gap between deployment speed and control fidelity.
Q: Why do AI agents and other NHIs create more governance risk than traditional user identities?
A: AI agents and NHIs can scale faster than human accounts, often operate across multiple systems, and may act without direct human review at runtime.
Q: How do organisations know if AI identity governance is working?
A: They should be able to answer three questions quickly: which agents exist, which credentials each one uses, and who is accountable for each identity’s lifecycle.
Practitioner guidance
- Inventory AI-driven identity paths Map every AI initiative to the human, machine, and agentic identities it creates, inherits, or depends on.
- Replace standing privilege with contextual authorization Use just-in-time issuance and session-based controls where AI workloads currently rely on always-on access.
- Validate why privileged actions occurred Require a traceable runtime context for every privileged NHI or AI agent action, including policy rationale, session lineage, and approval source where applicable.
Bottom line: AI adoption is forcing identity teams to relax controls faster than governance models can adapt, which shifts the risk from abstract visibility to operational accountability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/10/2026 2:39 am
AI expansion is now an identity governance pressure test, not a pure technology rollout. The article shows security teams being asked to loosen controls so AI initiatives can move faster, which means the governance model is being shaped by deployment pressure rather than risk tolerance. That is a programme-level problem because the control boundary changes before the identity model is ready.
A few things that frame the scale:
- 68% of organisations do not know how to fully address NHI risks, according to the Ultimate Guide to NHIs.
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations keep standing access for NHIs when AI adoption accelerates?
A: Only as a temporary exception, not as a default operating model. Standing access increases persistent privilege risk and makes it harder to separate legitimate automation from misuse. The better test is whether the organisation can issue access contextually and revoke it when the task ends.
👉 Read our full editorial: AI identity controls are loosening faster than governance can track