Topic starter
25/08/2026 6:10 pm
TL;DR: A broader identity shift is putting control-plane strain on IAM, as 96,000 entitlements per worker, 38% dormant IdP accounts, and only 55% of permissions are safe and compliant show, according to Veza. The practical lesson is that entitlement sprawl, dormant accounts, and unsafe permissions now need to be governed as one lifecycle problem, not separate IAM tasks.
Editorial analysis by NHI Mgmt Group, based on content published by Veza: “Company”.
By the numbers:
- 38% of IdP accounts are dormant, according to Veza’s 2026 State of Identity and Access Report.
- Only 55% of permissions are safe and compliant, according to Veza’s 2026 State of Identity and Access Report.
Key questions
Q: What breaks when identity reviews focus only on entitlements?
A: You lose sight of whether access is dormant, excessive, or actively abused.
Q: Why do AI agents change the access-control model compared with service accounts?
A: AI agents make decisions at runtime based on text they read, so the input can influence the action.
Q: How can teams tell whether permission sprawl is becoming a governance problem?
A: Look for growing entitlement counts, dormant accounts, and permissions that stay active after the business task changes.
Practitioner guidance
- Map the identity control plane Create one inventory of human users, service accounts, AI agents, and the entitlements they carry so governance can follow access relationships instead of isolated accounts.
- Measure permission quality Track scope, duration, and current ownership for permissions, then flag access that remains valid but no longer matches the business task or actor.
- Reduce dormant identity exposure Prioritise dormant IdP accounts and stale non-human identities for offboarding or revocation before they become reusable footholds in the access graph.
Bottom line: The article describes a control-plane problem in which entitlements, dormant accounts, and non-human access now move faster than traditional IAM governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/08/2026 6:11 pm
Enterprise identity is becoming a control-plane discipline, not an account-admin task. When a typical worker can sit behind 96,000 entitlements, the governing object is no longer a single account but the web of relationships around it. That changes how teams should think about ownership, review, and blast radius. The implication is that IAM and IGA need to operate as one control plane across humans, NHIs, and agents.
A question worth separating out:
Q: How do human, machine, and agent identities differ in one application stack?
A: Human identities authenticate people, while machine and agent identities authenticate workloads or software entities that may act without a person present. They should not share the same lifecycle assumptions, review cycles, or trust boundaries. The safest model is to govern each actor type separately, even when the application uses one identity platform.
👉 Read our full editorial: Veza's April 2026 update spotlights the enterprise agent control plane