Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: A wider shift toward unified access visibility, monitoring, lifecycle management, and NHI and AI agent governance across identity programmes is highlighted in Veza’s 2025 product innovation roundup. For practitioners, the signal is less about feature volume than about the convergence of governance controls around all identity types, including non-human and autonomous access.
NHIMG editorial — based on content published by Veza: 2025: The Year of Product Innovation
Questions worth separating out
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect.
Q: Why do lifecycle models break down for non-human identities?
A: Because NHI lifecycles are driven by workload change, application retirement, vendor relationships, and key expiry rather than employee movement.
Q: What do security teams get wrong about AI agent identity governance?
A: They often assume human IAM patterns can be reused with minor adjustments.
Practitioner guidance
- Map effective access across all identity types Consolidate entitlements, group memberships, delegated permissions, and application-level authorisation into one access inventory so reviews reflect effective access, not just recorded assignments.
- Tie NHI offboarding to system change events Trigger revocation when applications, workloads, vendors, or integrations are retired or replaced, and do not wait for periodic reviews to remove stale service account access.
- Separate runtime controls for autonomous systems Define a runtime authorisation layer for AI agents that can choose actions or tools independently, and monitor for scope drift, approval bypass, and unexpected tool use.
What's in the full article
Veza's full product update covers the operational detail this post intentionally leaves for the source:
- How Access Graph, Access Intelligence, and Access Monitoring are positioned across identity review workflows
- How NHI Security and AI Agent Security are organised inside the broader platform for practitioner use
- How Access Reviews and Lifecycle Management are intended to support access governance decisions
- How integrations and use-case packaging are grouped for teams evaluating operational deployment
👉 Read Veza's 2025 product innovation update on identity governance and NHI security →
Veza’s product innovation: what it means for identity teams?
Explore further
25/08/2026 6:11 pm
Access governance is collapsing into one operating model across human and non-human identities. The product direction here reflects a broader market reality: IAM, IGA, PAM, and NHI controls can no longer be managed as separate programmes. The decisive issue is effective access, not identity type. Practitioners should expect governance tooling to converge around the access graph because that is where human entitlement, service account privilege, and delegated AI access now intersect.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations unify NHI, IGA, and PAM workflows?
A: Yes, where effective access overlaps. The main reason is operational: privileged access, lifecycle review, and non-human entitlement management are increasingly describing the same risk surface. Unification does not mean one tool for everything. It means one governance model for who or what can reach sensitive systems and data.
👉 Read our full editorial: Veza's product innovation points to broader identity governance shifts
