Topic starter
04/06/2026 3:01 pm
TL;DR: AI agents are already in production at two-thirds of enterprises, yet governance is lagging as delegated actors inherit authority through chains humans and machines were not designed to track, according to Orchid Security and cited survey data. The core problem is that identity programmes assume access is stable, reviewable, and bounded by a single actor, which does not hold for agentic behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by Orchid Security: “Orchid Extends Industry-First Identity Control Plane in Response to Agentic Dark Matter Breaking the Established IAM Paradigm”.
By the numbers:
- 67% of nonhuman accounts are local, unseen and unmanaged by enterprises, according to Orchid Security.
- Orchid Security says the identity dark matter layer already represents 57% of enterprise identity.
Key questions
Q: What breaks when AI agents inherit loose human authority?
A: Loose human authority turns agent security into an amplification problem.
Q: Why do legacy IAM controls struggle with autonomous AI systems?
A: Legacy IAM controls assume stable identities, predictable requests, and access patterns that can be reviewed after the fact.
Q: How do security teams know whether an agent identity is actually governed?
A: An agent identity is governed only when teams can identify the owner, locate the credentials, define the allowed scope, and revoke access without hunting across endpoints or backup files.
Practitioner guidance
- Map delegation chains before expanding agent deployment Document the full authority path behind each agent, including originating identity, inherited permissions, connected services, and approval boundaries.
- Treat identity dark matter as an agent governance input Inventory unmanaged local accounts, dormant service accounts, hardcoded credentials, and other hidden identities that an agent could inherit or invoke.
- Move from periodic reviews to runtime authorization checks Design controls that validate access at the moment of action, not only at certification time.
Bottom line: Agent AI creates a governance gap because inherited authority and runtime action are no longer neatly tied to one stable identity.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
04/06/2026 3:14 pm
Agent AI exposes an authority model, not just an access model problem. The industry has spent years improving provisioning, certification, and role hygiene, but those controls assume the identity subject is stable and observable. When an agent inherits authority through a delegation chain, the real governance question becomes who is acting under whose authority and for how long. The implication is that IAM programmes must stop treating delegated execution as a special case and start treating it as the core case.
A few things that frame the scale:
- Organisations that describe themselves as confident in their AI deployment actually experience a 72% security incident rate, compared to 33% for those who remain cautious, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat AI SOC agents like governed identities?
A: Yes, because the practical risk is delegated access, not just model output. If an AI agent can read evidence, prepare actions, or trigger connected tools, it needs scoped permissions, defined task boundaries, and revocation when the workflow ends. That is the identity control model SOC teams already use for other non-human actors.
👉 Read our full editorial: Agent AI authority gaps expose the limits of legacy IAM models