Notifications
Clear all
Topic starter
25/06/2026 1:21 am
TL;DR: Application access governance is straining under AI adoption because enterprises now have to govern employees, contractors, service accounts, machine identities, bots, and AI agents across faster-moving business systems, according to Saviynt. Periodic review models were built for a slower, human-centric environment, and that assumption no longer holds when access changes continuously.
NHIMG editorial — based on content published by Saviynt: Rethinking Application Access Governance for the AI Era
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities - 46% confirmed, 26% suspected.
Questions worth separating out
Q: How should teams govern access when AI agents and service accounts share the same business systems?
A: Treat them as different identity subjects with the same governance obligation.
Q: Why do periodic access reviews struggle in AI-heavy environments?
A: Because risk changes faster than the review cycle.
Q: What do security teams get wrong about application access governance?
A: They often treat governance as an application-level compliance task rather than an identity-level security function.
Practitioner guidance
- Map governance coverage by identity type Separate human users, service accounts, machine identities, bots, and AI agents in your access governance inventory so that review, ownership, and lifecycle controls can be applied consistently across each class.
- Replace snapshot-only certification with continuous entitlement monitoring Use continuous visibility into application entitlements, privilege changes, and cross-system access paths so that risk is detected while it is forming rather than after a quarterly review.
- Tie access approvals to business process context Require each high-risk entitlement to be justified against the workflow it enables, especially where ERP, SaaS, cloud, and automation platforms are connected through one identity path.
What's in the full article
Saviynt's full blog post covers the operational detail this post intentionally leaves for the source:
- A live product demonstration of continuous access risk visibility across enterprise applications and workflows
- Practical examples of how access governance can extend across human and non-human identities in one control model
- A closer look at how organisations can interpret risk as identities, permissions, and business processes change over time
- The on-demand webinar format if you want to see the workflow rather than the editorial interpretation
👉 Read Saviynt's analysis of application access governance for the AI era →
AI-era application access governance: what IAM teams need to rethink?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 10:42 am
Identity governance is becoming a runtime discipline, not a periodic control. Periodic access reviews were built for slower change, where access could be sampled and certified after the fact. That model fails when access changes continuously across applications, automation, and AI-driven workflows. The implication is that governance teams must stop treating certification as the primary control boundary and start treating continuous entitlement state as the thing that defines risk.
A few things that frame the scale:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities - 46% confirmed, 26% suspected, according to 2024 ESG Report: Managing Non-Human Identities.
- Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks.
A question worth separating out:
Q: Who should own access risk when humans, machines, and AI agents all use the same workflows?
A: Ownership should sit with the programme that governs identity and access, not with each application team in isolation. Human IAM, IGA, PAM, and NHI governance need shared accountability because access risk now spans the full operating model. Separate ownership creates blind spots, especially where machine access is embedded in business process automation.
👉 Read our full editorial: Application access governance is out of sync with the AI era
