Topic starter
24/06/2026 10:32 pm
TL;DR: Identity governance is under pressure from executive blind spots, non-human identities, and agentic AI, with the State of Identity Governance 2026 calling out the resulting execution gap, according to Omada Identity. The central issue is not awareness but governance models that still assume access, accountability, and review cycles move at human pace.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “Analyst Reports”.
By the numbers:
- nearly 30% of IGA programs fail, according to Omada Identity's EMA research.
Key questions
A: The main failure is that certification and lifecycle controls assume a stable identity with a human-style ownership model.
Q: Why does NHI and agent sprawl create more risk than extra headcount can fix?
A: Because the problem is not only scale, but ownership and lifecycle drift.
Q: How do security teams know if IGA is actually keeping up with identity change?
A: Look at whether ownership, review status and retirement dates are current for every identity type, not just whether certifications were completed.
Practitioner guidance
- Define ownership for every non-human and agent identity Map each service account, token, certificate and AI-driven identity to a named business or technical owner, with a clear removal path when that owner changes.
- Shorten review cycles for fast-changing identities Move from broad periodic recertification to review cadences that reflect how quickly NHIs and agent permissions change in production.
- Embed lifecycle checks into provisioning and offboarding Require joiner-mover-leaver style controls for machine and agent identities so access is validated at issuance and revoked when the identity's purpose ends.
Bottom line: Identity governance is failing where its assumptions about stable ownership and slow-moving access no longer match AI and NHI-driven environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:15 am
Identity governance is no longer failing at policy design, it is failing at execution design. The article points to a programmatic gap that appears when access reviews, ownership and offboarding are built for human-paced change but are applied to NHI and agentic AI sprawl. The practical conclusion is that governance quality now depends on how quickly identity state can be brought under control, not on how complete the policy library looks on paper.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Should organisations treat non-human identities differently from human users in governance?
A: Yes. Non-human identities usually change faster, operate at higher volume, and are owned by systems rather than people. That means they need different review cadence, stronger lifecycle controls, and tighter evidence collection. A human-centric IAM process will miss much of the machine access risk.
👉 Read our full editorial: Identity governance is failing under AI and NHI sprawl