Topic starter
30/07/2026 9:42 am
TL;DR: Enterprises are now managing AI agents, applications, service accounts, and other non-human identities at machine speed, with unanswered questions around inventory, access, and accountability, according to Saviynt. The core issue is not visibility alone but whether identity governance can keep pace with autonomous behaviour, runtime authorization, and lifecycle control.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Introducing Zuma: The Enterprise AI Identity Security Platform”.
Key questions
Q: What breaks when AI agents are governed like ordinary service principals?
A: The main failure is that ordinary service-principal governance assumes a stable workload with predictable lifecycle and entitlement patterns.
Q: When should organisations use runtime authorization for AI agents?
A: Use runtime authorization when agent behavior can change based on context, tools, or delegated workflows.
Q: How do organisations know if AI identity governance is working?
A: They should be able to answer three questions quickly: which agents exist, which credentials each one uses, and who is accountable for each identity’s lifecycle.
Practitioner guidance
- Map every AI identity to an accountable owner Create a registry that ties each AI agent, application, and service account to a named business or technical owner, plus declared purpose and system scope.
- Replace standing grants with action-level checks Require runtime authorisation for high-risk AI actions so access is evaluated at the moment of execution, not only at initial provisioning.
- Inventory shadow AI and delegated access paths Continuously discover unsanctioned agents, service accounts, and tool integrations, then compare them against approved owners and policies.
Bottom line: AI identity security now has to cover agents, applications, service accounts, and human accountability in one governance model.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:57 pm
AI identity security is now a governance discipline, not a visibility project. Inventory matters, but only as the entry point to ownership, approval, review, and revocation. Once AI agents can act across systems in real time, the real question becomes whether the organisation can govern their behaviour as identities, not merely observe them as objects.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between managing human identities and non-human identities?
A: Human identity management focuses on people, sessions, and user lifecycle events, while non-human identity management focuses on service ownership, secret rotation, workload access, and machine-to-machine trust. The controls overlap, but the operating model is different because machine identities are persistent, automated, and easier to overlook.
👉 Read our full editorial: AI identity security now spans agents, workloads, and human control