Topic starter
22/06/2026 9:55 am
TL;DR: Enterprise identity programmes now have to govern both human access and machine behaviour: the article argues that IGA handles provisioning, certifications, and least privilege for people, while AI governance manages runtime actions, drift, and accountability for agents and bots, according to SecurEnds. The key gap is that valid credentials do not guarantee valid behaviour, so access control alone is no longer enough.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “Identity Governance vs. AI Governance: Why You Need Both (And Why They’re Not the Same Thing)”.
Key questions
Q: What breaks when AI systems are governed only through IGA?
A: IGA can prove who received access, but it cannot prove whether an AI agent used that access appropriately at runtime.
Q: Why do valid machine credentials still create AI governance risk?
A: Because credential validity only confirms that an identity may enter a system, not that its actions remain within policy.
Q: How should teams govern non-human identities in AI-heavy environments?
A: Teams should govern non-human identities the same way they govern other privileged assets: assign ownership, minimise scope, rotate credentials regularly, and monitor for abnormal use.
Practitioner guidance
- Inventory AI agents as governed identities Create a complete register of AI agents, bots, and machine accounts, including owner, credential type, data access, and business purpose.
- Separate provisioning controls from runtime controls Use IGA for access approval, certification, and revocation, then add runtime policy enforcement for tool use, data access, and workflow execution.
- Assign a named owner to every AI system Require a business and technical owner for each AI agent so policy exceptions, drift, and incident response have a clear accountable party.
Bottom line: IGA still matters, but it only governs access rights and certification, not the behaviour of AI systems once they begin acting in production.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 10:35 am
IGA is a permissions discipline, not a behaviour discipline: It was built to answer who should have access and whether that access can be attested. That model still matters for human users and machine identities, but it does not explain what an AI system does after credentials are issued. The implication is that identity governance teams must stop treating runtime conduct as a certification problem.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between identity administration and identity governance in an IGA programme?
A: Identity administration is about creating, updating, and removing accounts and access. Identity governance adds the policy layer that decides whether access should exist, whether it is compliant, and whether it can be justified over time. Administration moves identities through their lifecycle, while governance provides control, accountability, and evidence for business and regulatory oversight.
👉 Read our full editorial: AI governance and IGA are not the same discipline for identity