Topic starter
10/06/2026 11:29 pm
TL;DR: At Gartner IAM Summit EMEA, analysts repeatedly framed authorization as the missing layer for AI agents, with 13% of banks and 16% of insurers already deploying agents and another 34% planning to within 12 months, according to Cerbos. The practical issue is no longer whether agentic AI exists, but whether identity teams can govern delegated runtime decisions without collapsing into brittle DIY logic.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “Authorization became the main character at Gartner IAM London”.
Key questions
Q: How should security teams modernize application authorization without relying on static roles?
A: Security teams should move authorization out of the application and into centralized policy decisions based on scopes, claims, and source-of-truth attributes.
Q: Why do AI agents create problems for traditional IAM models?
A: Traditional IAM assumes stable identities, static roles, and access decisions that can be reviewed after the fact.
Q: What breaks when authorization ignores the calling application?
A: When authorization ignores the calling application, the API cannot tell whether a request came from the right actor, in the right workflow, with the right purpose.
Practitioner guidance
- Map agent authorization as a separate control plane Inventory where runtime decisions are currently hidden inside application code, API gateways, or ad hoc service logic, then identify which agent use cases need central policy evaluation instead.
- Separate policy decisions from enforcement points Use a policy decision point for evaluation and a policy enforcement point at each tool, proxy, or gateway that can block or allow the call in context.
- Define contextual inputs for agent decisions Require every authorization request to carry delegation chain, session state, resource, and action context so the policy engine can make a deterministic decision.
Bottom line: Agentic AI is forcing IAM teams to treat authorization as a distinct runtime control rather than a side effect of access management.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
12/06/2026 5:34 am
Authorization has become the control plane that determines whether agentic AI is governable at all. The article shows a category shift, not a feature discussion: analysts are now treating runtime authorization as its own layer because static roles and access management cannot express delegated tool use well enough. The practitioner conclusion is simple: if authorization remains buried inside legacy IAM, agent programmes will inherit brittle policy decisions and slow deployment.
A few things that frame the scale:
- Gartner predicts that by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024, and that 15% of day-to-day work decisions will be made autonomously.
A question worth separating out:
Q: How do teams decide whether to use AI in authorization decisions?
A: Use AI to analyse policy patterns, detect over-provisioning, and suggest better scopes, but keep the live allow or deny decision deterministic. That preserves auditability, repeatability, and consistent enforcement across environments. If the decision itself depends on model output, the control becomes harder to validate and defend.
👉 Read our full editorial: Gartner’s IAM summit shows authorization is now the agentic bottleneck
This post was modified 6 days ago by NHI Mgmt Group