Topic starter
16/10/2026 9:31 am
TL;DR: $60 million in seed funding will support an AI-native identity operating system that unifies human, machine, and AI agent governance in one live control plane, according to Oak. The core problem is not review speed but the collapse of static identity assumptions across ownerless accounts, standing privilege, and machine-speed change.
Editorial analysis by NHI Mgmt Group, based on content published by Oak: “Oak comes out of stealth with $60M in Seed Funding to Build the AI-Native Identity Operating System”.
Key questions
Q: Why do access reviews often fail to improve identity governance?
A: Access reviews fail when teams treat completion as success.
Q: Why do standing privileges and ownerless accounts become more dangerous in AI-heavy environments?
A: Because AI-heavy environments compress the time between privilege creation, use, and abuse.
Q: What are the signs that identity governance is too fragmented for agentic systems?
A: You see separate vault, PAM, IGA, and policy decisions with little shared context, inconsistent entitlements across surfaces, and audit records that cannot explain why a request was approved.
Practitioner guidance
- Map identity control gaps across all three identity classes Inventory where human, machine, and AI agent identities are governed in different systems, then identify which access paths are invisible outside each tool.
- Shorten the distance between access change and review Replace calendar-based review assumptions with controls that check current usage, ownership, and entitlement state closer to the moment access is granted or modified.
- Create a governance path for ownerless identities Establish explicit ownership and offboarding rules for service accounts, homegrown apps, and AI agents that do not map cleanly to employee lifecycle processes.
Bottom line: Identity governance built around periodic review no longer matches environments where machine and AI identities change continuously.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
16/10/2026 9:32 am
Identity governance is moving from periodic certification to continuous control. The article reflects a structural break in the old assumption that access can be reviewed after it is granted and still remain relevant. That assumption was designed for slower environments with fewer identity objects and more stable ownership. It fails when human, machine, and AI agent identities change faster than review cycles can observe them. The implication is that identity governance is becoming a runtime discipline, not a calendar discipline.
A question worth separating out:
Q: What should security teams do before automating identity decisions?
A: They should decide which decisions are safe to automate, which require policy constraints, and which must remain human-approved. Automation should accelerate governance, not replace it. If the programme cannot explain why a decision was made, it is too opaque for identity security.
👉 Read our full editorial: Oak's identity operating system bet reframes governance at scale