Topic starter
14/05/2026 2:33 pm
TL;DR: Enterprise AI is entering an agentic era in which non-human identities can outnumber human workers 100 to 1, forcing identity programmes to discover, govern and audit AI agents across business workflows, according to SailPoint. The assumption that access can be reviewed after issuance collapses when agents act at machine speed and leave little stable state to certify.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Introducing the SailPoint Agentic Fabric: Securing the new era of enterprise AI”.
By the numbers:
- Non-human identities will soon outnumber human employees by a staggering 100 to 1, according to SailPoint.
Key questions
Q: What breaks when AI agents are reviewed like human users?
A: Human review assumes access is stable long enough to be observed, approved, and recertified.
Q: Why does giving AI agents direct access to security workflows create governance risk?
A: Direct agent access reduces friction, but it also compresses the gap between request and action.
Q: How do organisations know if agent governance is actually working?
A: Agent governance is working when every agent is discoverable, owned, least privileged, and auditable at the action level.
Practitioner guidance
- Inventory every AI agent and its sponsor Build a complete register of agents, the human or team responsible for them, and the systems each agent can influence.
- Map agent relationships to data and workflows Document which data sources, business processes and downstream identities each agent can reach so least privilege is applied to real execution paths, not assumptions.
- Define runtime controls for agent access Move beyond periodic certification by enforcing access boundaries, monitoring behaviour and revoking privileges when the agent exceeds its intended scope.
Bottom line: AI agents are entering the identity model as governed non-human identities, which changes the scope of IAM, IGA and PAM work.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/05/2026 2:35 pm
Agentic identity governance is becoming a mainstream identity discipline, not a niche AI add-on. Once AI agents can operate across supply chains, finance and customer workflows, they behave like a governed identity population that must be inventoried, owned and constrained. The relevant question is no longer whether the agent is intelligent, but whether the organisation can explain its access path and accountability chain. The practitioner conclusion is straightforward: identity programmes now have to absorb agentic software into core governance.
A few things that frame the scale:
- Enterprise AI use rose from 55% of organisations in 2023 to 88% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: What is the difference between service account governance and AI agent governance?
A: Service account governance usually focuses on static workloads with known patterns, while AI agent governance must account for autonomous decisions, changing tool use, and unpredictable execution paths. Agents need tighter policy boundaries, more frequent review, and stronger monitoring because they can alter their own operating context during use.
👉 Read our full editorial: Agentic identity governance now needs visibility, control, and audit