Topic starter
24/06/2026 10:35 pm
TL;DR: Identity security has to govern cloud, hybrid, and AI agent access as identities and entitlements change quickly, according to SailPoint. Visibility and lifecycle control now have to span human users, machine identities, and AI agents to keep access decisions current.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “A conversation with KOGIT: How identity security powers innovation and compliance”.
Key questions
Q: Why do traditional access reviews miss non-human identity risk?
A: Traditional access reviews are built around people, managers, and stable directories.
Q: What should organisations prioritise first in identity governance programmes?
A: Start with the entitlements that create the most risk when they drift, usually groups, application roles, and directory-linked access.
Q: How should security teams govern access when bots and AI agents act like non-human identities?
A: Security teams should classify bots and AI agents as governed identities, not as informal automation.
Practitioner guidance
- Define one access inventory across identities Map human users, service accounts, and AI agents into a single inventory so entitlement decisions are made against one authoritative view of access.
- Rework certification for fast-changing access Shorten the distance between access issuance and review for identities whose privileges change frequently, especially AI agents and other non-human identities.
- Tie compliance evidence to lifecycle events Record joiner, mover, leaver, provisioning, and offboarding events as part of the evidence chain so access can be shown to be current, not merely approved.
Bottom line: The article frames identity security as the control layer for cloud, hybrid work, and AI agent access.
Glossary terms: Identity Security, Non-Human Identity (NHI), Access Certification, AI Agents
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 7:20 am
Access review programmes are only as strong as the stability assumption they rely on. Traditional IAM governance assumes that access remains visible, attributable, and reviewable long enough for a periodic control to catch it. That assumption weakens when cloud sprawl, hybrid work, and AI agents continually reshape the entitlement landscape. The practical conclusion is that identity programmes now need governance that can keep pace with changing access states, not just certify them later.
A question worth separating out:
Q: How should security teams balance agility with identity control in cloud and AI environments?
A: Anchor access in policy, not informal trust. Use least privilege, conditional access, and short-lived entitlements so business teams can move quickly without creating permanent exposure. The key is to make access changeable at the same pace as the environment, while keeping ownership, approval, and revocation explicit.
👉 Read our full editorial: AI agents make continuous identity governance the compliance test
This post was modified 1 day ago by NHI Mgmt Group