Topic starter
22/06/2026 10:05 am
TL;DR: As agent-mediated commerce expands and traditional human-centric identity models no longer answer who authorized an action or what the agent was allowed to do, enterprises now need governance for AI agents acting on behalf of customers and partners, including transactional authorization, auditability, KYA verification, and self-service revocation, according to Strivacity. The governance gap is no longer theoretical: identity programmes must account for delegated, non-human action at the customer layer.
Editorial analysis by NHI Mgmt Group, based on content published by Strivacity: “Strivacity Advances Agentic Identity to Help Enterprises Govern AI Agents Acting on Behalf of Customers and Partners”.
Key questions
Q: What breaks when organisations treat autonomous AI agents as if they were delegated user actions?
A: When autonomous agents are treated like delegated human actions, accountability becomes blurred and authorization can be misapplied.
Q: Why do customer and partner agents create accountability problems for IAM teams?
A: Because the actor that performs the action may not be the actor that authorised it.
Q: How can organisations tell whether agent permissions are still aligned to customer intent?
A: By checking whether the permitted actions still match the original delegation scope and by making revocation easy for the customer or partner.
Practitioner guidance
- Define delegated-action boundaries Separate actions an agent may perform independently from actions that require explicit approval, and express that line in transaction-level policy rather than general account permission.
- Bind audit trails to delegation provenance Log the acting agent, the authorising customer or partner, the scope granted, and the resulting action as one evidence chain so review teams can reconstruct authority later.
- Establish external agent assurance checks Require pre-access verification for outside agents before they can touch customer accounts or partner systems, including the ability to revoke trust when the agent relationship changes.
Bottom line: AI agents acting for customers and partners create a governance problem that human identity systems were never designed to solve cleanly.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 10:50 am
Delegated action is now an identity problem, not just an application behaviour problem: once AI agents can transact for customers and partners, the programme must govern delegation rather than only login. Traditional CIAM assumes a stable human principal behind the session; this article describes a world where the acting entity and the accountable entity may diverge. The implication is that identity teams must treat authorised delegation as a first-class control plane.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should teams require Know Your Agent verification before access is granted?
A: They should require it whenever an external agent requests access to customer accounts, partner systems, or other resources where the enterprise does not control the agent's lifecycle. Pre-access assurance is the right place to stop a weak or unknown agent, because post-access investigation does not undo unauthorised delegation.
👉 Read our full editorial: Agentic identity governance now extends to customer and partner actions