Topic starter
09/07/2026 1:41 pm
TL;DR: Privilege is shifting from vaulting admin accounts to governing actions taken by service accounts, automation pipelines and AI agents, according to Delinea’s summary of two 2026 analyst reports. Runtime authorisation, not credential storage alone, is now the control point that determines whether privilege is actually constrained.
Editorial analysis by NHI Mgmt Group, based on content published by Delinea: “Privilege is moving from accounts to actions: Why KuppingerCole and Frost recognized Delinea”.
Key questions
Q: What breaks when PAM still centers on accounts instead of actions?
A: Account-centric PAM misses the decision point that now matters most.
Q: Why do standing privileges make machine identities harder to secure?
A: Standing privileges extend the period in which a compromised secret can be abused, which enlarges the blast radius of a single exposure.
Q: How can organisations tell whether runtime authorization is actually working?
A: Look for three signs: decisions happen fast enough to stay inline, policies use live context instead of stale claims, and every allow or deny produces an auditable record.
Practitioner guidance
- Map privilege to actions, not just accounts Inventory the high-risk actions performed by service accounts, pipelines and AI agents, then identify where today’s controls only govern the credential rather than the action decision.
- Reduce standing privilege for non-human identities Replace durable machine credentials with task-scoped access where the workload can support it, so access exists only for the window needed to complete the action.
- Separate observation from enforcement Keep session recording and audit trails, but add a runtime authorisation layer that can approve or deny the action before it executes.
Bottom line: Privilege governance is moving from account custody to action control, especially where machines and AI agents are the active identities.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 1:45 pm
Privilege has moved from accounts to actions, and PAM has to follow it. The old unit of control was the admin account, but the real privilege boundary now sits inside the action itself. That shift matters because service accounts, automation pipelines and AI agents can carry privilege without looking like classic administrator sessions. Practitioners should treat runtime authorisation as the core control model, not an optional extension of vaulting.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When should teams prioritise just-in-time access over session recording?
A: Prioritise just-in-time access when the risk comes from standing privilege, fast-moving cloud operations, or machine-speed workflows that cannot wait for later review. Recording can supplement governance, but it should not be the first line of defence when the goal is to prevent privileged misuse before the session begins.
👉 Read our full editorial: Privilege is moving from accounts to actions in PAM