Topic starter
15/08/2026 12:47 pm
TL;DR: Opal Security says access governance now spans employees, service accounts, and AI agents, with Paladin, Access Campaigns, OpalScript, and MCP updates built around one access graph and a cited 43.5% of granted access going unused. The old assumption that access can be reviewed on a human cadence no longer holds when decisions and requests move at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Opal Security: “New in Opal: Paladin, Access Campaigns, and OpalScript hit GA”.
By the numbers:
- 43.5 percent of granted access goes unused, according to Opal Security.
Key questions
Q: What breaks when AI agent access is reviewed only after the fact?
A: After-the-fact review leaves a gap between action and containment.
Q: When should teams prioritise policy-as-code over manual approval handling?
A: Teams should prioritise policy-as-code when the same access request can be judged differently by different reviewers or at different times.
Q: What are the signs that standing access is creating governance drift?
A: The clearest signals are unused entitlements, reviewer inconsistency, and access that persists long after the task is complete.
Practitioner guidance
- Map governance rules to actor speed Review which access decisions still assume a human reviewer and a stable entitlement window.
- Encode approval logic as policy Move recurring access decisions into versioned policy so the same request produces the same result regardless of reviewer or time of day.
- Shorten the lifetime of non-human access Replace standing keys and broad agent entitlements with scoped, expiring access that matches the task.
Bottom line: Access governance is moving from human-paced review to issuance-time enforcement because agents and service accounts can change state faster than manual certification cycles.
What's in the full announcement
Opal Security's full product update covers the operational detail this post intentionally leaves for the source:
- How Paladin decides when to advise versus escalate during access approval
- Campaign-building workflow details for filtering, grouping, reassignment, and bulk reminders
- OpalScript examples for enforcing separation of duties and duration limits
- MCP and OAuth configuration details for scoped, expiring agent access
👉 Read Opal Security’s product update on access campaigns and agent governance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 12:47 pm
Access governance is no longer a human-only discipline. Once agents request access through the same control plane as employees and service accounts, identity governance has to cover request timing, policy execution, and revocation across all three actor types. The discipline is shifting from certification-centric oversight to issuance-centric control, and that changes what IGA can safely assume.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should security teams design MCP server access for AI agents?
A: Security teams should design MCP access around a small set of agent goals, not a mirrored list of REST endpoints. Group related backend calls into workflows, expose known data as resources, and reserve tools for actions that truly change state. That keeps the agent oriented, reduces context churn, and makes the access surface easier to review and govern.
👉 Read our full editorial: Opal’s access campaigns and agent governance shift IGA assumptions