Topic starter
22/09/2026 3:43 pm
TL;DR: Agent sprawl, unclear ownership, and policy lag turn every access decision into a governance problem, and AI agents need just-in-time access governance, not permanent grants, according to Opal Security. The central issue is that standing access and human-paced review cycles assume stable, reviewable privilege, which agentic systems quickly invalidate.
NHIMG editorial — what this means for NHI practitioners
By the numbers:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
Questions worth separating out
Q: How should teams think about AI agent privileges?
A: Teams should treat AI agent privileges as task-scoped and time-bound, with the same discipline used for other high-risk non-human identities.
Q: Why do AI agents create more cloud access risk than human users?
A: AI agents can chain API calls quickly, interact with multiple services in one session, and operate without the familiar human signals that security tools expect.
Q: What breaks when AI agent access is reviewed only after the fact?
A: After-the-fact review leaves a gap between action and containment.
Practitioner guidance
- Inventory every AI agent and bind it to an owner Require a complete record for each agent that includes owner, purpose, current access, and the systems it can reach.
- Replace standing grants with expiring agent access Set access to expire by default and force renewal at the point of access when the policy still matches the request.
- Route agent requests through policy at the execution point Evaluate agent requests in the gateway or request path so approval and enforcement happen together.
What's in the full announcement
Opal Security's full product post covers the operational detail this analysis intentionally leaves for the source:
- How Opal Zero evaluates agent requests using owner, purpose, current access, and blast radius at decision time.
- How Gateway Sync applies scoped, time-bound policy in the gateway already in place.
- How Policy Insights scores access hygiene, approval efficiency, right-sizing, and time to access.
- How the product maps agent inventory across Okta, Entra, Anthropic, AWS Bedrock AgentCore, OpenAI, Cursor, and other sources.
👉 Read Opal Security's introduction to Opal Zero and agent access governance →
Agent access governance: can just-in-time control keep pace?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
22/09/2026 3:43 pm
Standing access is the wrong default for AI agents. The article’s core point is that agent identity should be governed as a time-bound decision problem, not a permanent entitlement problem. That matters because agent behaviour changes at runtime, while standing access assumes the opposite. The practical conclusion is that access governance for agents has to start from expiration, not persistence.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to The 2026 Infrastructure Identity Survey.
- Another finding from the same survey shows that systems with least-privileged AI access had a 17% incident rate versus 76% for over-privileged systems.
A question worth separating out:
Q: Should organisations prioritise agent inventory or access policy first?
A: Start with inventory, because you cannot govern what you cannot name, own, or scope. Once agents are visible, policy can reduce standing access and enforce time-bound grants, but discovery comes first when ownership and purpose are already unclear.
👉 Read our full editorial: Opal Zero reframes agent access as just-in-time governance
