Notifications
Clear all
Topic starter
25/06/2026 5:25 pm
TL;DR: Identity teams need one governance model that spans workforce, machine, and AI-driven access instead of treating them as separate programmes, according to Saviynt. Saviynt positions its identity platform around governing human and non-human access across applications, data, and business processes, with AI-powered identity security, just-in-time access, and non-human identity capabilities called out in its newsroom context.
NHIMG editorial — based on content published by Saviynt: newsroom and platform overview material on identity governance, NHI, and AI-enabled access
By the numbers:
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should organisations govern non-human identities and human access in one model?
A: Use one governance framework, but classify identities separately so the controls match the actor.
Q: When does just-in-time access fail to reduce privilege risk?
A: JIT fails when access is still broad, poorly logged, or not revoked after task completion.
Q: What do security teams get wrong about AI agent identity governance?
A: They often focus on model behaviour and ignore the access plane.
Practitioner guidance
- Inventory non-human identities separately from workforce accounts Create an explicit register for service accounts, API keys, tokens, certificates, and application identities so they can be governed as first-class identities rather than infrastructure artefacts.
- Align JIT access with entitlement expiry and revocation Require task-scoped approval, short-lived privilege, and verified revocation for privileged access paths that support administrative work and machine operations.
- Define governance rules for AI agents before rollout Document which tools, datasets, and action types an AI agent may use, then bind those permissions to approval and logging requirements that are reviewable by IAM and security teams.
What's in the full article
Saviynt's full newsroom coverage includes the operational detail this post intentionally leaves at the governance level:
- How Saviynt positions AI-powered identity security across human, non-human, and business-process access.
- Where its NHI and just-in-time access capabilities sit in the broader Identity Cloud model.
- How the platform frames governance for machine identities and AI agents in enterprise access workflows.
- Which parts of the identity stack the vendor groups under ISPM, PAM, and IGA.
👉 Read Saviynt's newsroom coverage of human and non-human identity governance →
Human and non-human access governance: what Saviynt is framing?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 6:05 pm
Identity security is being pushed into a multi-actor governance model. Saviynt’s own framing reflects where the market has gone: human identities are no longer the only identity class that matters, and machine access is now part of the core governance surface. That shift changes programme design because reviews, entitlements, and lifecycle controls must work across different execution patterns. Practitioners should treat identity scope as organisationally shared, not tool-specific.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: How do organisations know if machine identity governance is working?
A: Look for visibility, ownership, and revocation speed. If you cannot identify who owns a service account, why it exists, or how quickly access is removed after change, the programme is not controlling machine identity risk. Effective governance shows up as fewer orphaned credentials, narrower privilege, and faster offboarding.
👉 Read our full editorial: Saviynt’s identity platform framing for human and non-human access
