Topic starter
25/06/2026 2:33 pm
TL;DR: Identity governance is moving toward one control plane spanning workforce, workload, and agent access, not separate programmes, according to Saviynt. It positions its identity cloud around governing human and non-human access across applications, data, and business processes, while extending coverage to machine identities, AI agents, JIT access, and MCP tooling.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Newsroom”.
Key questions
Q: How should IAM teams govern AI agent access differently from human developer access?
A: IAM teams should govern AI agents as runtime consumers of access, not as users with durable credentials.
Q: Why do machine identities create governance risk in transactional systems?
A: Because the device identity becomes both the access token and the audit boundary.
Q: What are the signs that a JIT programme is not really enforcing least privilege?
A: Common warning signs include rubber-stamped approvals, long approval delays, frequent bypasses, and repeated access requests that look identical regardless of context.
Practitioner guidance
- Define one governance model for all actor types Map workforce, workload, and AI-mediated access into a single lifecycle and entitlement model so reviews and offboarding follow the same policy logic across identity classes.
- Inventory non-human identities separately from apps Maintain an authoritative inventory of service accounts, workload identities, tokens, and agent access paths so ownership and revocation are never inferred from application ownership.
- Bind JIT access to task scope Require each temporary grant to carry a clear business task, time boundary, and revocation condition so short-lived access does not become unreviewed privilege.
Bottom line: The article argues for one governance plane across human and non-human access, rather than separate controls that drift apart.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:42 pm
Unified governance is becoming the baseline expectation for identity programmes. The article reflects a broader market move away from separate workforce and machine identity processes toward a shared control model. That shift is rational because entitlement sprawl, inconsistent reviews, and fragmented offboarding create the same risk pattern across human and non-human access. Practitioners should treat that as a programme design question, not a product feature question.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams evaluate MCP-connected access paths in identity governance?
A: They should verify that every MCP path is tied to a clear identity, a narrowly scoped entitlement, and an explicit expiry condition. If the path can reach tools or data without that binding, the governance model is too loose to support consistent accountability.
👉 Read our full editorial: Saviynt’s identity cloud and what it means for NHI governance