Notifications
Clear all
Topic starter
25/06/2026 2:31 pm
TL;DR: Identity governance is increasingly being framed around human and non-human access across applications, data, and business processes, while also highlighting AI agent and MCP capabilities that signal broader identity convergence, according to Saviynt. The strategic takeaway is that IAM teams must treat NHI, human access, and agentic workflows as one governance surface rather than separate programmes.
NHIMG editorial — based on content published by Saviynt: newsroom and platform overview for identity security, NHI, and AI agent coverage
By the numbers:
- Over 100 million identities protected, and counting.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should security teams govern human and non-human access together?
A: Security teams should govern human and non-human access under a common identity policy model, but not a common lifecycle assumption.
Q: When does just-in-time access fail for machine identities?
A: Just-in-time access fails for machine identities when the underlying credential remains persistent even if the entitlement looks temporary.
Q: What do IAM teams get wrong about AI agent access?
A: IAM teams often assume AI agent access can be managed like ordinary application entitlement, but runtime decision-making changes the problem.
Practitioner guidance
- Classify identity types before consolidating controls Inventory humans, service accounts, API keys, certificates, workload identities, and AI agent identities separately, then map which approval, recertification, and offboarding rules apply to each.
- Validate machine credential visibility end to end Check whether secrets are visible only in a vault or also in code, CI/CD, configuration, and vendor integrations.
- Separate scripted automation from runtime decision authority For MCP-connected or AI-assisted workflows, determine whether the system is following a fixed workflow or making independent tool and timing decisions.
What's in the full article
Saviynt's full newsroom post covers the operational detail this post intentionally leaves for the source:
- The platform areas and newsroom categories Saviynt is prioritising across identity security, PAM, NHI, and AI-related access.
- The specific product framing behind Saviynt MCP Server and ISPM for AI Agents, which this post treats only as market context.
- The company’s own positioning on how its product set maps to customer identity governance requirements.
- The surrounding newsroom and solution context that shows how Saviynt is organising its identity security portfolio.
👉 Read Saviynt’s newsroom overview of identity security, NHI, and AI agent coverage →
Saviynt’s identity platform: what it means for IAM and NHI teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 3:40 pm
Identity convergence is now the governing reality, not a future state. Saviynt’s platform framing shows how vendors are collapsing human identity, non-human identity, privileged access, and AI-related access into one operating surface. That does not mean the control problems are solved together. It means practitioners must evaluate whether one governance model can actually enforce different lifecycle, approval, and privilege rules across actors that behave very differently. The practitioner conclusion is that platform breadth is not the same as governance coherence.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: How do organisations know whether identity governance is actually working?
A: Organisations know identity governance is working when they can prove that access is discoverable, reviewable, and revocable across humans and non-human identities without manual exception handling. If credentials live in code, CI/CD, or undocumented integrations, governance is partial at best. Evidence should show control continuity from issuance to expiry.
👉 Read our full editorial: Saviynt’s identity platform framing shifts for human and NHI governance
