Topic starter
16/01/2026 12:28 pm
TL;DR: AI systems will initiate 50% of service requests by 2030, while over 60% of enterprises are expected to secure the AI lifecycle through dedicated platforms, according to Gartner, and Gartner’s Emerging Tech report places Astrix Security in the Agentic AI Security category. The practical issue is not model intelligence but runtime identity, authorisation, and governance for agents that act across trust boundaries.
Editorial analysis by NHI Mgmt Group, based on content published by Astrix Security: “Identity: The Missing Link in Agentic AI Security – Astrix Named in New Gartner® Report”.
By the numbers:
- Gartner expects more than 60% of enterprises to secure the AI lifecycle through AI security platforms by 2030, up from less than 10% in 2025.
- Astrix Security says 35% of senior cybersecurity leaders suspect unsanctioned use of GenAI but lack concrete visibility into where and how it is being used.
Key questions
Q: What breaks when AI agents inherit access from users and service accounts?
A: The main failure is that inherited access can be broader than the agent’s actual task, so privilege becomes easier to reuse than to govern.
Q: Why do AI agents change the way organisations think about runtime authorisation?
A: Because the decision to act now happens inside the session, not only at provisioning time.
Q: How do security teams know if AI governance is working?
A: Look for evidence that access decisions are reviewable, permissions are revocable, and exceptions are not becoming permanent.
Practitioner guidance
- Map every AI agent to an identity owner Create an inventory of all AI agents, embedded copilots, and autonomous workflows, then tie each one to a named business and technical owner so no agent sits outside accountability.
- Separate agent discovery from access approval Do not approve runtime access for an agent until its associated non-human identities, credentials, and tool connections are visible in one inventory and reviewed together.
- Apply runtime authorisation to every agent session Use policy-based controls to scope tool calls, API access, and data access to the current task, then log each decision for later audit and investigation.
Bottom line: Agentic AI turns identity into a runtime control problem because autonomous agents can initiate actions, call tools, and cross trust boundaries without waiting for a human review cycle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/10/2026 5:00 pm
Agentic AI exposes an identity governance assumption that was designed for stable, human-paced subjects. Access provisioning, review, and revocation models assume the actor is known, inventoryable, and slow enough to govern between sessions. That assumption fails when the actor can initiate work, select tools, and move through systems at runtime. The implication is that identity governance has to move from static subject management to live control of agent behaviour.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations treat service accounts and AI agents under the same authorization model?
A: Yes. Service accounts, AI agents, and other workloads are all non-human principals that need centrally governed access decisions, even if their runtime behaviour differs. Treating them under one authorization model reduces blind spots, exposes overprivilege faster, and gives security teams a common way to enforce least privilege across delegated machine identity.
👉 Read our full editorial: Agentic AI security exposes the identity gap in enterprise control