Topic starter
23/03/2026 1:56 pm
TL;DR: Microsoft 365 E7: Frontier Suite and Agent 365 point to a workplace where AI agents join human users in enterprise workflows, according to RSA Security, while Gartner projects 33% of enterprise apps will include agentic AI by 2028 and other research shows NHIs already outnumber human users 17X. Identity trust, not just user authentication, becomes the governing control plane.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Securing the AI Workforce – How RSA Strengthens Identity Security in the Era of Microsoft 365 E7 Frontier Suite”.
By the numbers:
- Gartner predicted 33% of enterprise apps will include agentic AI by 2028, up from less than 1% in 2024.
- Other research shows non-human identities outnumber human users 17X.
Key questions
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do autonomous AI systems change the way IAM teams think about least privilege?
A: Least privilege becomes harder to define when intent is not fixed at provisioning time.
Q: What are the signs that AI workforce identity controls are too weak?
A: Warning signs include agents sharing broad service credentials, workflow access that is not tied to a named owner, and audit trails that show actions but not the initiating identity chain.
Practitioner guidance
- Define separate governance policies for AI agents Classify which workflows can be initiated by agents, which require human initiation, and which require explicit approval before execution.
- Scope agent privileges to task boundaries Review whether an AI agent needs read, write, or privileged access for each workflow step, then remove any entitlement that is not required for that task.
- Strengthen identity proofing for high-risk access Require phishing-resistant authentication for administrators and sensitive workflow owners who can approve or modify AI-driven access paths.
Bottom line: AI workforce identity security extends governance beyond human login controls to cover the access, trust, and accountability of AI agents inside enterprise workflows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/10/2026 2:40 am
AI workforce identity is now a blended governance problem, not a human IAM problem with a new label. Once agents can access applications and execute workflow steps, the control boundary must cover both subject identity and machine behaviour. That means IGA, PAM, and authentication policies have to be assessed together rather than in separate silos. Practitioners should design for shared workflows, not separate identity worlds.
A few things that frame the scale:
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How do organisations keep AI agent credentials from becoming standing privilege?
A: Organisations should use short-lived tokens where possible, store secrets in a secrets manager, and make revocation part of the deployment and offboarding workflow. The goal is to avoid persistent credentials that outlive the agent's purpose. Without lifecycle controls, even a well-scoped agent credential becomes standing privilege in practice.
👉 Read our full editorial: AI workforce identity security is moving beyond human-only controls