Topic starter
25/06/2026 5:23 pm
TL;DR: Machine, agent and human access are converging under one identity model, Saviynt argues, with governance spanning non-human access, AI agents and privileged control. Identity teams then have to certify and revoke access that can appear and disappear inside a single runtime session.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Newsroom”.
By the numbers:
- Saviynt says it protects over 100 million identities and counting.
Key questions
Q: Why does Just-in-Time access matter more as NHIs and AI agents spread?
A: Because standing privilege becomes harder to justify when access is only needed briefly, and the blast radius of a compromised or misused identity grows with persistence.
Q: What breaks when agent access reviews are designed like human access reviews?
A: Agent access reviews break when they assume a stable user, stable role, and stable review interval.
Q: How should security teams govern non-human identities that have persistent access?
A: Security teams should treat every non-human identity as a managed asset with an owner, an explicit purpose, a scoped privilege set, and a defined offboarding path.
Practitioner guidance
- Map NHI ownership to accountable teams Create a named owner for every service account, token, certificate and API key so non-human access has an explicit lifecycle custodian.
- Separate standing privilege from task-scoped access Review where workloads, bots and privileged users still hold persistent access that could be issued on demand instead.
- Define governance rules for AI agent delegation Document which tools an agent may use, when access can be requested, and what evidence must be retained after execution.
Bottom line: Saviynt's framing reflects a market shift toward governing human, non-human and agent access through one identity control plane rather than separate programmes.
Glossary terms: Non-Human Identity (NHI), Just-in-Time Access Request, Identity Governance, AI Agent Identity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
25/06/2026 6:01 pm
Identity governance is moving from account administration to control-plane governance. Saviynt's framing reflects a broader market shift: teams are no longer buying identity tooling only for joiner-mover-leaver workflows or recertification. They are being asked to govern humans, NHIs and AI agents under one policy and evidence model, which raises the bar for ownership, lifecycle state and privilege visibility. The practical conclusion is that identity programmes need to be designed as shared control planes, not separate workstreams.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What governance questions should teams ask before allowing AI agents to use privileged tools?
A: Teams should ask who owns the agent, which tools it may invoke, what scope of authority it can exercise, and what evidence will prove it stayed inside that scope. Without those answers, delegated access becomes difficult to certify, revoke or investigate after the fact.
👉 Read our full editorial: One identity model now has to govern humans, NHIs and agents
This post was modified 2 days ago by NHI Mgmt Group