Notifications
Clear all
Topic starter
06/07/2026 9:40 am
TL;DR: Insurance CIAM must now handle passkeys, federated login, delegated access, and AI agent permissions as insurers move toward mobile claims and embedded partnerships, according to Descope. The governance gap is no longer just customer friction, but whether identity controls can distinguish people, partners, and autonomous tools at runtime.
NHIMG editorial — based on content published by Descope: Insurance CIAM considerations and best practices
By the numbers:
- 93% of insurance leaders now cite customer experience as a top priority for 2025.
- 90% of insurance organizations plan to increase GenAI funding in 2025, fueling the rise of internal copilots and backend automation agents.
Questions worth separating out
Q: How should insurers govern delegated access in customer-facing workflows?
A: Insurers should treat delegated access as a time-bound, relationship-specific entitlement, not as a permanent role.
Q: Why do AI agents complicate insurance identity governance?
A: AI agents complicate governance because they can act through APIs, shared tokens, or backend workflows without behaving like a human user.
Q: How can security teams keep insurance login flows secure without hurting conversion?
A: Use adaptive authentication so low-risk sessions stay smooth and high-risk actions trigger stronger checks only when needed.
Practitioner guidance
- Map every insurance actor class Separate policyholders, brokers, partner firms, internal staff, and AI-driven workflows into distinct identity and access models so the programme does not apply one access pattern to all users.
- Convert delegated access into scoped entitlements Define who can act on behalf of whom, for which data, and for how long, then make expiry and revocation part of the default access lifecycle.
- Tighten AI agent access to customer systems Issue short-lived tokens, restrict agent permissions to specific API calls, and require audit logs that show which workflow, dataset, or customer record the agent touched.
What's in the full article
Descope's full guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of adaptive MFA and step-up authentication for insurance customer journeys
- Implementation guidance for RBAC, ABAC, and ReBAC in multi-party insurance ecosystems
- Operational patterns for delegated access, self-service administration, and audit logging
- Practical treatment of AI agent access, token lifecycle controls, and scoped API permissions
👉 Read Descope's guide to insurance CIAM, delegated access, and AI agent risk →
Insurance CIAM and AI agents: are your controls keeping up?
Explore further
06/07/2026 9:55 am
Insurance CIAM is becoming a governance layer for mixed identity populations, not just customers. The article is really describing a control environment where policyholders, brokers, third parties, and AI-driven workflows all share the same access fabric. That changes CIAM from a login problem into an entitlement and accountability problem. The practitioner takeaway is that insurance programmes now need to classify who or what is acting before deciding how access should be granted.
A few things that frame the scale:
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
A question worth separating out:
Q: Who should own auditability for third-party access in insurance CIAM?
A: Ownership should sit with the identity programme, not with application teams alone. Auditability needs to cover authentication, delegated authorisation, and the actions taken after access is granted. If logs cannot connect the actor, the relationship, and the transaction, the access model is not fully governable.
👉 Read our full editorial: Insurance CIAM now faces AI agent access and delegation risk
