Topic starter
23/06/2026 9:12 pm
TL;DR: 1.3 billion AI agents by 2028 shows the scale of identity governance pressure, according to Saviynt's survey and analysis. IAM programmes now have to cover people, workloads, and agents together instead of treating each actor type as a separate review lane.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Saviynt & Ashisuto Form Japan Identity Security JV”.
By the numbers:
- IDC projects there will be 1.3 billion AI agents by 2028.
- Deloitte’s 2026 State of AI Report found that only one in five organizations have achieved mature governance for autonomous AI agents.
Key questions
Q: Why does local implementation matter in identity security programmes?
A: Local implementation matters because identity controls only reduce risk when they are deployed, operated, and evidenced in the environments where business processes run.
Q: What breaks when autonomous agents are governed like human users?
A: Session-based IAM breaks first, because autonomous agents can make and execute decisions between review points.
Q: How can IAM teams tell whether AI and NHI governance are actually unified?
A: Look for one policy model, one identity inventory, and one review process that covers people, workloads, and agent-linked access.
Practitioner guidance
- Align identity scope to actor type Separate human, NHI, and autonomous AI governance in your identity inventory so lifecycle ownership, approval paths, and offboarding rules are explicit for each class.
- Localize governance execution Check whether policy enforcement, support escalation, and implementation ownership can be executed in the region where the business operates, not only at headquarters.
- Define autonomous system ownership Assign a clear business owner and technical custodian for each autonomous system before it is granted access to production data or workflows.
Bottom line: AI-era identity governance now spans human accounts, NHI, and autonomous systems, so IAM scope has to follow actor behaviour rather than legacy account categories.
Glossary terms: AI-Driven Identity Governance, Autonomous AI system, Non-Human Identity (NHI), Identity Sprawl
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 hours ago by NHI Mgmt Group
25/06/2026 2:23 am
AI-era identity governance is becoming a programme design issue, not a deployment detail. The article shows that regional expansion is being framed around governance, compliance, and cyber resilience, which is the right lens. Once enterprises add autonomous systems and expanding NHI estates, identity architecture has to absorb more subject types, more lifecycle states, and more policy exceptions. The practitioner conclusion is straightforward: IAM scope now has to be defined by actor behaviour, not by legacy account categories.
A question worth separating out:
Q: How should security teams use AI without creating more identity risk?
A: Use AI for detection, correlation, and response only after identity ownership, asset inventory, and secret management are reliable. AI should narrow triage and speed containment, but it should not be trusted to compensate for stale entitlements, exposed credentials, or weak verification of high-risk requests.
👉 Read our full editorial: Japan JV points identity governance toward AI-era access
This post was modified 6 hours ago by NHI Mgmt Group