Topic starter
25/08/2026 6:10 pm
TL;DR: Identity governance is moving toward a control-plane model for human users, non-human identities, and AI agents, while Forrester projects IAM spending will reach about $27.5 billion by 2029 according to Veza. The real shift is that authorization, not just authentication, is becoming the hard boundary enterprises must govern.
Editorial analysis by NHI Mgmt Group, based on content published by Veza: “Veza + ServiceNow: The Enterprise Agent Identity Control Plane”.
Key questions
Q: How should security teams govern identity as a control plane?
A: Security teams should treat identity as the layer that decides who can act, how far authority travels, and what context makes an action legitimate.
Q: Why do AI agents complicate traditional IAM reviews?
A: Traditional IAM review assumes identities have human lifecycle events such as hire, role change, or offboarding.
Q: What breaks when organisations audit AI agents like service accounts?
A: Audit trails break when teams record only the API call and ignore the prompts, tools, and model outputs that caused it.
Practitioner guidance
- Define the enterprise authorization model Establish a canonical view of who can take what action on what data across human, NHI and AI agent identities.
- Inventory non-human and agent access paths Map the access paths used by service accounts, API-driven workflows and AI agents, then identify where privilege is inherited, duplicated or left unused.
- Separate workflow control from access authority Do not let orchestration layers become the implicit source of authorization truth.
Bottom line: The article’s central shift is from identity as a login layer to identity as an authorization control plane across people, machines and AI agents.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
Identity is becoming a control plane because authorization, not authentication, now determines enterprise risk. The article reflects a structural shift that many IAM programmes have been slow to acknowledge. Once access spans users, service identities and AI agents, the decisive governance question becomes what each subject can do after it is authenticated. Practitioners should treat authorization as the primary boundary for enterprise control.
A question worth separating out:
Q: What is the difference between application authentication and identity governance?
A: Authentication proves a user can sign in. Identity governance proves the right user still has the right access over time, with traceability and lifecycle control. Applications that stop at login can function technically while still failing compliance, access review, and offboarding expectations.
👉 Read our full editorial: ServiceNow acquires Veza: identity control plane implications