Topic starter
23/01/2026 2:27 pm
TL;DR: Gartner’s Emerging Tech Impact Radar: 2026 places IAM for AI agents in a high-impact security, sovereignty and governance category, with early majority adoption expected within one to three years as gaps in delegation, revocation and auditability block scale, according to Astrix Security. Agent governance is shifting from pilot concern to operating assumption.
Editorial analysis by NHI Mgmt Group, based on content published by Astrix Security: “Astrix Recognized in Gartner 2026 Emerging Tech Impact Radar for Identity and Access Management for AI Agents”.
Key questions
Q: What breaks when AI agent access is managed like standard IAM access?
A: What breaks is the assumption that access is stable, reviewable, and tied to a single human owner.
Q: Why do AI agents create risk even when they stay within approved permissions?
A: AI agents can be authorised correctly and still produce harmful outcomes because permission is not the same as intent or behavioural appropriateness.
Q: What do IAM teams need to measure to know whether agent governance is working?
A: Measure whether every agent action can be tied to a unique identity, a scoped permission set, and a closed session.
Practitioner guidance
- Define agent identity ownership Assign a named owner to every AI agent, including embedded and third-party agents, so delegated access does not become anonymous operational debt.
- Inventory shadow AI access paths Continuously discover AI agents, MCP servers and other non-human identities across SaaS, cloud and workflow systems before access sprawl outpaces governance.
- Replace static grants with policy-based authorisation Use policy evaluation that limits what an agent may do in each context instead of copying human role bundles into machine workflows.
Bottom line: AI agent governance is no longer an experimental side issue, because runtime access decisions now sit inside the identity problem itself.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 5:00 pm
IAM for AI agents is becoming a control-plane problem, not a feature request. Once agents can act across business systems, identity stops being a login concern and becomes a runtime governance concern. The practical issue is not whether the agent can be authenticated, but whether its delegated authority is bounded, observable and reversible across the full action path. Practitioners should treat agent identity as an access model that must be governable end to end.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: Should organisations treat AI agents as NHI or as application automation?
A: They should treat them as governed non-human identities with application behaviour. That framing captures the need for identity, scope, lifecycle, and audit controls while still recognising that agents operate through APIs, tools, and workflows. Pure automation language hides the governance gap.
👉 Read our full editorial: Gartner elevates IAM for AI agents as enterprise governance expands