Notifications
Clear all
Topic starter
25/06/2026 5:24 pm
TL;DR: Identity programmes are moving from account-centric control to lifecycle governance across every actor type that can hold access, according to Saviynt. Saviynt positions its identity platform around human access, non-human identities, and AI agent governance, with over 100 million identities protected and a growing set of product areas spanning ISPM, JIT access, PAM, and MCP server support.
NHIMG editorial — based on content published by Saviynt: its latest newsroom overview of identity platform developments
By the numbers:
- Over 100 million identities protected, and counting!
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should organisations govern human, machine, and AI agent access in one programme?
A: Organisations should govern all three through one identity model, but with actor-specific controls for provisioning, review, and revocation.
Q: Why do non-human identities create more governance risk than traditional user accounts?
A: Non-human identities often outnumber human identities, carry excessive privilege, and are harder to inventory accurately.
Q: When should teams treat AI agents as governed identities rather than application logic?
A: Teams should treat AI agents as governed identities when the system can select tools, decide actions, and execute without human approval.
Practitioner guidance
- Define one governance owner per actor type Assign explicit ownership for human identities, non-human identities, and AI agent access so provisioning, review, and revocation do not fragment across separate teams.
- Inventory machine and delegated access first Map service accounts, API keys, certificates, and workflow tokens before expanding policy scope.
- Bind JIT and PAM to expiry and task completion Make sure temporary access for privileged workflows ends on task completion or session closure, not on an arbitrary calendar cycle.
What's in the full article
Saviynt's full article covers the platform scope and product areas this post intentionally leaves at the architectural level:
- A closer look at the Identity Cloud modules that map to NHI governance, JIT access, PAM, and application access governance.
- The specific positioning of Saviynt MCP Server and ISPM for AI Agents in the broader identity security stack.
- How the vendor is framing support for machine identities, external identities, and compliance workflows across regulated industries.
- The full set of product and solution categories listed across the newsroom, which helps implementation teams understand scope boundaries.
👉 Read Saviynt's overview of its identity platform coverage for human, NHI, and AI agent access →
Saviynt's NHI and AI agent scope: what does it change for teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 6:03 pm
Identity security is moving from user governance to actor governance. The article reflects a market reality that identity programmes can no longer be built around human users alone. Service accounts, machine identities, and AI agents now participate in business processes and therefore deserve the same lifecycle, review, and access boundaries. Practitioners should read this as a governance expansion, not a tooling nuance.
A few things that frame the scale:
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should IAM teams measure to know whether identity governance is working?
A: They should measure whether every identity type has an owner, a revocation path, and a review cadence that actually removes stale access. Good governance shows up in fewer orphaned credentials, faster offboarding, and clean audit evidence for machine and delegated access. If those signals are missing, the programme is still account-centric.
👉 Read our full editorial: Saviynt's NHI and AI agent identity platform signals broader governance scope
