Notifications
Clear all
Topic starter
05/07/2026 9:28 pm
TL;DR: Autonomous agents are multiplying fast, but weak workforce identity controls are still the foundation problem: roughly half of employees hold excessive or privileged access, and overloaded certification workflows push people toward rubber-stamp approvals, according to Clear Skye. AI governance will fail if the humans provisioning it remain under-governed.
NHIMG editorial — based on content published by Clear Skye: The Identity Problem Hiding Behind the AI Hype
By the numbers:
- A recent 2025 survey found that roughly half of employees carry excessive or privileged access.
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: What breaks when workforce identity is not under control before AI agent rollout?
A: The agent layer inherits the same excess privilege, unclear approvals, and weak accountability already present in the human identity layer.
Q: Why do AI agent programmes depend on human IAM maturity?
A: Because humans still define who can create, approve, and supervise the agent's access.
Q: How do you know if access certification is working in practice?
A: Look for low exception rates, clear entitlement understanding, and few help desk escalations caused by review friction.
Practitioner guidance
- Right-size workforce entitlements before agent rollout Review the access held by the people who will provision, approve, and monitor AI agents.
- Simplify access certification paths Shorten review lists, clarify entitlement descriptions, and route exceptions through explicit escalation rather than broad approval queues.
- Measure whether users can complete governance tasks without bypassing them Track how often requests go to the help desk, how many approvals are rushed, and how frequently reviewers approve without evidence.
What's in the full article
Clear Skye's full blog post covers the operational detail this post intentionally leaves for the source:
- How Clear Skye frames workforce identity workflows inside ServiceNow for day-to-day access administration.
- The specific usability arguments it makes for reducing certification friction and help desk dependence.
- The article's full discussion of ServiceNow's AI Control Tower direction and its relevance to machine and non-human identity governance.
- The broader sequence Clear Skye recommends for organisations balancing human identity cleanup with emerging AI oversight.
👉 Read Clear Skye's analysis of the hidden identity problem behind AI hype →
AI agent governance: why workforce identity still comes first?
Explore further
05/07/2026 9:31 pm
Human workforce identity is the hidden dependency behind AI governance. AI agents are configured and approved by people, so the quality of workforce identity controls determines the quality of agent governance before any runtime behaviour appears. If excessive access already exists in the human layer, the agent inherits a permissive operating model rather than a constrained one. The implication is that agent governance cannot be evaluated in isolation from workforce IAM.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who is accountable when an AI agent acts on excessive access granted by a human?
A: Accountability sits with the identity governance process that allowed the excessive entitlement in the first place, not only with the runtime behaviour of the agent. If the human approver, reviewer, or provisioning path is weak, the breach begins in governance. That is why workforce identity and agent oversight must be managed as linked controls.
👉 Read our full editorial: Human workforce identity is the hidden blocker to AI agent governance
