Topic starter
12/06/2026 9:36 pm
TL;DR: 66% of organisations now give AI agents equal or greater system access than human users, while only 37% have fully folded those agents into formal IAM policies, highlighting a widening governance gap for machine-speed identities according to JumpCloud. The real issue is not scale alone, but the assumption that access can still be reviewed and governed on human cadences.
Editorial analysis by NHI Mgmt Group, based on content published by JumpCloud: “JumpCloud Launches Agentic IAM on Google Cloud”.
By the numbers:
- 66% of organisations now give AI agents equal or greater system access than human users.
- Only 37% have fully integrated those agents into their formal IAM policies.
Key questions
Q: What breaks when agentic AI is governed like a normal application account?
A: Security controls break down because agentic systems do not behave like fixed-function applications.
Q: Why do AI agents increase IAM risk even when tokens are short-lived?
A: Short-lived tokens reduce exposure time, but they do not answer whether the agent should have received that scope in the first place.
Q: What are the signs that agentic access is escaping formal governance?
A: The clearest signals are unmanaged agents, inconsistent onboarding, permissions granted outside IAM policy, and gaps between what an agent can reach and what the access model says it should reach.
Practitioner guidance
- Map all agentic actors into a single identity inventory Inventory every AI agent, connector, and delegated workflow alongside service accounts and human identities so governance teams can see who or what is acting in production.
- Define policy for agent access before broad rollout Write explicit rules for agent onboarding, allowed resources, token scope, approval conditions, and offboarding so agent access is not created ad hoc by application teams.
- Bind high-risk actions to operator context Require device posture checks and human initiation evidence for sensitive agent workflows where the request still originates from a person, especially when the agent can reach multiple applications.
Bottom line: Agentic IAM extends identity governance to AI-driven actors that can request and consume access at machine speed, which exposes the limits of human-centric review cadences.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/06/2026 11:48 pm
Agentic IAM is exposing a governance model that was never designed for machine-speed actors. Human IAM assumes users can be enrolled, reviewed, and recertified on human timelines. That assumption fails when an AI agent can acquire and spend access inside the same operational window, so the issue is not merely more identities but identities whose lifecycle outruns existing governance cadences. Practitioners should treat this as a control-plane redesign problem, not a feature rollout.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations govern AI agents alongside human identity and device access?
A: Organisations should treat AI agents as a separate identity class with their own entitlement boundaries, logging expectations, and approval model. Human IAM controls often assume interactive sign-in and review cycles, which do not fit autonomous or programmatic access. The safer approach is to define actor-specific policy and verify which access paths can be delegated without expanding trust unnecessarily.
👉 Read our full editorial: Google Cloud-hosted agentic IAM exposes the new access governance gap