Topic starter
22/06/2026 10:08 am
TL;DR: Identity governance is shifting toward continuous background control rather than periodic human workflow, with Lumos saying its Identity Agent Force continuously governs access across human, machine, and AI identities, including access reviews, access requests, role mining, entitlement analysis, NHI ownership, and agent ownership.
Editorial analysis by NHI Mgmt Group, based on content published by Lumos: “Lumos Launches the Identity Agent Force to Govern Access for Every Human, NHI, and AI Identity”.
Key questions
Q: How should security teams authorize AI agents that need changing access over time?
A: Security teams should model AI agents as first-class identities with explicit relationships to resources, teams, and shared data.
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect.
Q: What breaks when NHI ownership is missing?
A: When NHI ownership is missing, access reviews lose context, incident response slows, and stale identities persist longer than they should.
Practitioner guidance
- Map high-churn identities to continuous controls Identify the users, service accounts, API keys, tokens, and AI agents whose access changes too often for periodic review to be reliable.
- Assign accountable owners to every NHI and agent Require a named human owner for each service account, token, and AI agent so that dormant, over-scoped, or abandoned access can be remediated without ambiguity.
- Convert entitlement analysis into business context Translate technical permissions into plain-English access meaning so approvers can see what an entitlement actually enables before it is approved or retained.
Bottom line: Identity governance is moving from periodic review to continuous control because access now changes at machine speed across humans, NHIs, and AI agents.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 10:54 am
Access governance built for human-paced review cycles cannot keep up with machine-paced identity change. The article is really about control latency: access reviews, certifications, and manual approvals were designed for slower entitlement churn. Once NHIs and AI agents move continuously, the governance model starts certifying stale state instead of current risk. Practitioners should read this as a signal that cadence-based governance is now a coverage gap, not a maturity badge.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What does continuous identity governance change for IGA teams?
A: Continuous governance shifts IGA from ticket processing and certification queues toward always-on decision support. Teams spend less time pushing routine approvals and more time defining policy, ownership, and exception boundaries that can be enforced automatically across humans, NHIs, and agents.
👉 Read our full editorial: Lumos Identity Agent Force reframes access governance for AI