Notifications
Clear all
Topic starter
24/06/2026 11:48 pm
TL;DR: Identity programmes now have to treat NHI, AI agent, and human governance as one control surface rather than separate projects, according to Saviynt. Saviynt says its AI-powered identity platform governs human and non-human access across applications, data, and business processes, and claims over 100 million identities protected.
NHIMG editorial — based on content published by Saviynt: its newsroom overview of identity platform, NHI, and AI-focused governance
By the numbers:
- Over 100 million identities protected, and counting.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
Questions worth separating out
Q: How should teams govern human and non-human identities in one programme?
A: Teams should use one governance model with separate control expectations for humans, service accounts, and AI agents.
Q: When does just-in-time access fail for non-human identities?
A: Just-in-time access fails when the underlying credential or entitlement remains persistent even though the operational workflow appears temporary.
Q: What do security teams get wrong about AI agent identity?
A: They often treat an AI agent like a normal service account with a new label.
Practitioner guidance
- Inventory identity classes under one governance model Classify human users, service accounts, tokens, certificates, and AI agents separately, then map each to the same lifecycle stages: request, approval, review, revocation, and evidence.
- Test whether access is truly ephemeral Review where high-risk access is still standing privilege in practice, especially for privileged NHI and delegated access paths.
- Validate runtime boundaries for AI agents Define what an AI agent may do, which tools it may call, and when human approval is required before execution proceeds.
What's in the full article
Saviynt's full newsroom coverage covers the operational detail this post intentionally leaves for the source:
- How Saviynt positions its platform across human identity, NHI, and AI agent use cases in one operating model
- The specific product areas mentioned in the newsroom page, including identity security posture management, just-in-time access, and application access governance
- How the vendor frames customer and market context behind its identity security messaging
- The broader newsroom and solution context that implementation teams would use when comparing control coverage
👉 Read Saviynt’s newsroom coverage of its identity platform and NHI governance focus →
Saviynt’s identity platform: what it means for NHI and AI governance?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
25/06/2026 8:43 am
Identity governance is converging because the risk surface is converging. Saviynt’s framing reflects a broader market reality: organisations can no longer maintain separate control logic for workforce identities, machine identities, and emerging AI agent identities. The governance problem is shared even when the execution model differs, so the discipline is moving toward one access lifecycle with different actor types underneath it. Practitioners should treat that convergence as a governance redesign, not a branding exercise.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when delegated access outlives the original business need?
A: Accountability sits with the team that owns lifecycle enforcement, not the system that merely issues access. If offboarding, review, and revocation do not follow the identity’s real operating life, the organisation has created access that persists beyond its business justification.
👉 Read our full editorial: Saviynt’s identity platform points to broader NHI and AI governance
