Topic starter
25/08/2026 6:10 pm
TL;DR: Identity governance is shifting toward authorization as the control plane for people, machines and AI agents, according to Veza. Teams now need evidence that access decisions hold up operationally and for compliance, not just that logins succeed.
Editorial analysis by NHI Mgmt Group, based on content published by Veza: “Veza + ServiceNow: The Enterprise Agent Identity Control Plane”.
Key questions
Q: Why do AI agents complicate traditional IAM reviews?
A: Traditional IAM review assumes identities have human lifecycle events such as hire, role change, or offboarding.
Q: What breaks when organisations audit AI agents like service accounts?
A: Audit trails break when teams record only the API call and ignore the prompts, tools, and model outputs that caused it.
Q: How should security teams govern identity as a control plane?
A: Security teams should treat identity as the layer that decides who can act, how far authority travels, and what context makes an action legitimate.
Practitioner guidance
- Define the enterprise authorization model Establish a canonical view of who can take what action on what data across human, NHI and AI agent identities.
- Inventory non-human and agent access paths Map the access paths used by service accounts, API-driven workflows and AI agents, then identify where privilege is inherited, duplicated or left unused.
- Separate workflow control from access authority Do not let orchestration layers become the implicit source of authorization truth.
Bottom line: The article’s central shift is from identity as a login layer to identity as an authorization control plane across people, machines and AI agents.
Glossary terms: Control Plane, Authorization Data Sharing, Effective Privilege, Canonical Access Model
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 hours ago by NHI Mgmt Group
25/08/2026 6:11 pm
Identity is becoming a control plane because authorization, not authentication, now determines enterprise risk. The article reflects a structural shift that many IAM programmes have been slow to acknowledge. Once access spans users, service identities and AI agents, the decisive governance question becomes what each subject can do after it is authenticated. Practitioners should treat authorization as the primary boundary for enterprise control.
A question worth separating out:
Q: What is the difference between application authentication and identity governance?
A: Authentication proves a user can sign in. Identity governance proves the right user still has the right access over time, with traceability and lifecycle control. Applications that stop at login can function technically while still failing compliance, access review, and offboarding expectations.
👉 Read our full editorial: ServiceNow acquires Veza: identity control plane implications
This post was modified 5 hours ago by NHI Mgmt Group