Topic starter
10/06/2026 11:58 pm
TL;DR: Demand for authorization management platforms grew 4x in 2025 as enterprises pushed into AI agents, MCP servers, and non-human identities that inherit human-era permissions, making runtime authorization, auditability, and least privilege harder to sustain according to Cerbos. The real shift is that access decisions are now happening too fast, too often, and too contextually for static role models to keep up.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “Year in review: 2025”.
Key questions
Q: How should security teams govern AI agents and NHIs differently?
A: Security teams should govern NHIs as predictable machine identities and AI agents as runtime actors that can alter behaviour after authentication.
Q: Why do inherited human credentials create more risk for AI agents?
A: Inherited credentials collapse the boundary between the human who owns the account and the machine that is using it.
Q: What are the signs that distributed authorization is not keeping pace with policy changes?
A: Common signs include transient access denials immediately after a role or team change, especially for automated clients, and inconsistent results between regions during the propagation window.
Practitioner guidance
- Define runtime authorization boundaries Map which AI agents, MCP servers, and NHIs make independent access decisions and require explicit policy evaluation at the moment of use.
- Externalize policy lifecycle management Move policy creation, review, deployment, and rollback into a versioned workflow so changes are auditable across tenants and environments.
- Separate human and machine permission models Review inherited permissions that were designed for human users and replace them with subject-specific authorization rules for NHIs and agents.
Bottom line: AI agents and NHIs expose the limits of static role-based access by making contextual decisions at runtime.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
12/06/2026 6:25 am
Runtime authorization has become the control surface for AI agents and NHIs. Cerbos’ 2025 framing is a sign that static permission models are no longer enough when subjects make context-dependent decisions at machine speed. The field is moving from identity assignment to decision governance, where the real question is whether access can be evaluated at the moment of use. Practitioners should treat authorization as a runtime control, not a provisioning afterthought.
A question worth separating out:
Q: How should teams prove authorization decisions to auditors?
A: Teams should log each authorization check with request context, the rule evaluated, and the final decision, then keep those records centrally available for review. The goal is not just observability, but evidence that can reconstruct access outcomes after the fact without manual log collection across services.
👉 Read our full editorial: Authorization management in 2025: why AI and NHI changed the model
This post was modified 6 days ago by NHI Mgmt Group