Topic starter
22/06/2026 10:07 am
TL;DR: AI-driven identity operations are shifting from quarterly human certification to continuous agent-led decisions, according to Lumos, as the article argues that attackers increasingly target legitimate identities rather than traditional perimeter controls. The governance problem is no longer review volume alone, but whether IAM can keep pace with machine-speed access change.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “When Machines Fight Machines: Why You need a Team of Agents”.
Key questions
Q: What breaks when AI agent access is reviewed only after the fact?
A: After-the-fact review leaves a gap between action and containment.
Q: Why do standing API keys and service-account secrets increase compromise risk?
A: Because they create a durable trust path that attackers or unauthorised workloads can reuse after discovery.
Q: What are the signs that non-human identity governance is starting to slip?
A: Warning signs include reliance on manual upgrade paths, ad hoc secret handling, and fragmented access management across tools and environments.
Practitioner guidance
- Map every standing non-human credential Identify service accounts, API keys, and other non-human identities that still have persistent access, then tie each one to an owner, workload, and business purpose.
- Move routine access decisions out of quarterly review Reserve human review for exceptions and high-risk grants, while using continuously refreshed policy to handle low-risk, repetitive access decisions that change too quickly for manual certification.
- Reduce privilege on AI and workload identities Scope AI agents, service accounts, and workload identities to the minimum access needed for their current function, then validate that their permissions still match the workflow they actually run.
Bottom line: AI agent governance is pushing identity teams away from batch certification and toward continuous control over access that changes too quickly for quarterly review.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 10:53 am
Manual access review is no longer the right control plane for agent-speed identity change. Quarterly certification was designed for relatively slow-moving human access, not for AI agents and service accounts whose privileges can shift continuously. When identity state changes faster than review cadence, the review process becomes observational rather than preventive. The implication is that identity governance must move its control point upstream, to issuance and live enforcement.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams split work between humans and identity automation?
A: Humans should define policy, approve exceptions, and decide on ambiguous cases. Automation should handle repeated access decisions, continuous monitoring, and routine enforcement at machine speed. That split works only if the underlying identity data is accurate enough for machines to trust it.
👉 Read our full editorial: AI agent identity governance is moving from manual review to fleets