Topic starter
28/05/2026 11:38 am
Agentic identity maturity is now a governance discipline, not a feature checklist: once AI agents can act across clouds and tools at machine speed, the question is no longer whether IAM supports them in theory, but whether the organisation can govern their lifecycle, scope, and runtime behaviour as a single identity problem. The programme that treats agents as just another account class will under-control discovery and over-trust delegation. Practitioners should therefore measure identity maturity by how well it handles agent registration, telemetry, and task-scoped authorization.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What should organisations do when AI agents cross cloud and platform boundaries?
A: They should treat cross-platform movement as a governance boundary problem, not just an integration problem. The practical test is whether one policy and observability layer can follow the agent across clouds, orchestrators, and delegated tool use without losing owner, scope, or audit context.
👉 Read our full editorial: Agentic identity maturity exposes the limits of traditional IAM
28/05/2026 11:43 am
Identity governance is becoming the control plane for AI agents, not a companion function. The article reflects a structural shift: discovery, governance, PAM, and posture management can no longer be treated as separate towers when the same actor graph spans humans, workloads, and agents. The practitioner conclusion is that identity teams need one enforcement model with different lifecycle rules, not three disconnected programmes.
A few things that frame the scale:
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams evaluate a platform that covers human, NHI, and AI agent identities?
A: Evaluate it by asking whether it preserves distinct governance semantics for each identity type. Human IAM, NHI lifecycle, and AI agent delegation do not fail in the same way, so a single console is not enough. The key test is whether ownership, evidence, and enforcement remain clear when identities are mixed in one operating model.
👉 Read our full editorial: Identity security for AI agents needs unified NHI governance