Notifications
Clear all
Topic starter
17/08/2026 4:36 pm
TL;DR: CIAM built for human-only journeys is now being stretched by partners, fraud controls, consent, and AI agents, and the operational pain shows up as fragmented stacks, slower launches, and inconsistent policy enforcement, according to Strivacity. The deeper issue is architectural: customer identity now has to govern delegation, not just authentication.
NHIMG editorial — based on content published by Strivacity: Five signs you've outgrown Okta or Ping Identity for CIAM
By the numbers:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
Questions worth separating out
Q: How should teams govern AI agents inside CIAM platforms?
A: Treat AI agents as distinct identity subjects with scoped credentials, explicit consent, and a traceable link back to the human or organisation that authorised them.
Q: Why do legacy CIAM stacks become bottlenecks for new digital journeys?
A: Legacy CIAM stacks slow launches when each new journey requires cross-product configuration, specialist identity knowledge, or custom integration work.
Q: What breaks when customer identity is split across multiple products?
A: Policy consistency, troubleshooting, and lifecycle visibility break first.
Practitioner guidance
- Map the CIAM control surface Inventory every product, module, and service that influences authentication, orchestration, consent, fraud, analytics, and delegated access.
- Test delegated identity end to end Verify that AI agent or partner delegation carries the customer principal, approved scope, expiration, and revocation path in one continuous identity record.
- Treat journey failures as identity signals Correlate sign-in, recovery, registration, and abandonment data with fraud controls and policy changes.
What's in the full article
Strivacity's full article covers the operational detail this post intentionally leaves for the source:
- The five diagnostic signs in a form teams can use during CIAM renewal reviews and architecture assessments.
- The article's full explanation of how customer, partner, and AI agent identity are intended to share one policy model.
- The vendor's discussion of dedicated single-instance SaaS and identity insights as part of its CIAM positioning.
- The specific questions the vendor recommends asking when evaluating whether a CIAM stack has become a portfolio.
👉 Read Strivacity's analysis of why legacy CIAM is straining under AI and partners →
CIAM architecture and AI agents: where legacy identity stacks break?
Explore further
17/08/2026 4:43 pm
CIAM fragmentation is now a governance problem, not a packaging problem. When identity functions are split across modules and consoles, policy consistency becomes dependent on human memory and integration quality. That means the organisation is governing customer identity through exceptions, not through a single policy model. Practitioners should treat portfolio sprawl as an identity control failure, not just a commercial arrangement.
A few things that frame the scale:
- strong>From our research: 88.5% of organisations acknowledge that their non-human IAM practices lag behind or are merely on par with their human identity and access management efforts, according to The 2024 Non-Human Identity Security Report.
- Only 19.6% of security professionals express strong confidence in their organisation's ability to securely manage non-human workload identities, which shows how immature the control baseline remains.
A question worth separating out:
Q: Should isolation and predictable performance be part of the default CIAM design?
A: Yes. Customer identity sits directly in the revenue path, so isolation and predictable performance are baseline requirements, not premium extras. When those capabilities are gated behind higher editions, the organisation is paying to compensate for architectural limitations rather than buying additional control.
👉 Read our full editorial: Legacy CIAM is straining under AI, partners and agent identity
