Topic starter
03/06/2026 7:24 pm
TL;DR: Large-scale agentic AI adoption is pushing identity infrastructure into a control-plane role for both human and non-human identities, according to Curity, which also named Monica Enand as Chair of the Board. The market signal is clear: identity programmes now need to govern autonomous systems and NHI scale at the same time, not as separate problems.
Editorial analysis by NHI Mgmt Group, based on content published by Curity: “Monica Enand Appointed Chair of the Board at Curity”.
Key questions
Q: How should security teams govern machine identity credentials in agentic AI environments?
A: Security teams should extend secrets scanning to cover MCP configuration files, enforce short-lived credentials for all agent workloads, and assign clear ownership to every non-human identity regardless of its origin , human-created or AI-generated.
Q: Why do autonomous SOC tools change identity governance requirements?
A: Autonomous SOC tools change identity governance because they make decisions at runtime rather than following a fixed script.
Q: What breaks when NHIs are managed outside identity governance?
A: Ownership becomes unclear, offboarding is missed, and reviews stop reflecting actual operational access.
Practitioner guidance
- Define the identity control plane Map the policy, authentication, authorisation, and lifecycle functions that must govern humans, NHIs, and autonomous systems together.
- Separate actor types in governance design Document which controls apply to human users, which apply to service accounts and tokens, and which must adapt for autonomous behaviour.
- Review delegated authority paths Identify where runtime access is granted through chained delegation so policy does not assume a single stable actor behind the action.
Bottom line: Agentic AI is pushing identity teams toward a control-plane model that spans human access, NHIs, and autonomous systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
03/06/2026 7:27 pm
Identity control plane is the right lens for agentic AI governance: agentic systems create a new class of runtime decision-making that cannot be governed as if they were static workloads or ordinary users. The control plane has to account for who initiated action, what policy allowed it, and whether that authority was reusable, ephemeral, or delegated. That makes the identity layer the centre of operational control, not a peripheral dependency. Practitioners should treat this as a governance architecture shift, not a feature request.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: Should organisations prioritise identity governance before expanding agentic AI?
A: Yes. Organisations should establish ownership, least privilege, monitoring, and revocation for machine identities before broadening agentic AI use. Without those controls, each new agent can multiply blast radius and create shadow access that is hard to unwind after an incident.
👉 Read our full editorial: Curity board change signals growing pressure on identity control planes