Topic starter
25/06/2026 2:33 pm
TL;DR: Identity platform coverage now spans human and non-human access, including NHI governance, just-in-time access, and an MCP server for AI agents, positioning identity as a single control plane across application, data, and process access, according to Saviynt. The governance question is less about feature breadth than whether one model can safely cover service accounts, tokens, and agents with different trust assumptions.
Editorial analysis by NHI Mgmt Group, based on content published by Saviynt: “Newsroom”.
Key questions
Q: Should organisations use the same controls for humans, NHIs, and AI agents?
A: No. The control family may overlap, but the operating assumptions differ. Human identity controls focus on authentication and user context, while NHIs need lifecycle and credential governance, and AI agents require both NHI controls and runtime oversight for autonomous action. The correct model is shared governance with actor-specific enforcement.
Q: Why do just-in-time controls not solve NHI governance on their own?
A: JIT reduces standing privilege, but it does not fix where secrets live, who can still use them, or whether third parties still retain access.
Q: What breaks when AI tools are exposed through loosely governed MCP servers?
A: Loose governance lets model-driven tools cross from context retrieval into state-changing actions without enough oversight.
Practitioner guidance
- Map identity types separately Separate human users, service accounts, tokens, certificates and AI agents in your governance model so review, ownership and offboarding do not share the same assumptions.
- Define JIT as a privilege control Use just-in-time access to remove standing privilege, but keep NHI inventory, rotation and revocation controls outside the JIT workflow.
- Set runtime boundaries for AI agents If an MCP server is in scope, document which tools, data sets and business actions an agent may request before the session begins.
Bottom line: Saviynt’s update is mainly about governance scope, not just feature breadth, because it brings humans, NHIs and AI-agent connectivity into one identity plane.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 3:42 pm
Unified identity coverage does not equal unified governability. Bringing humans, NHIs and AI-agent connectivity into one platform may improve visibility, but visibility alone does not solve the fact that these subjects have different lifecycle rules and trust assumptions. Service accounts, tokens and agents need ownership, scope and offboarding logic that can survive beyond a generic access workflow. The implication is that governance models must stay identity-type aware even when the control plane is shared.
A question worth separating out:
Q: Should organisations use one access workflow for human users and non-human identities?
A: Usually not. Human users, service accounts and agents differ in ownership, review cadence and offboarding requirements, so a single workflow often hides the controls that matter most for each identity type.
👉 Read our full editorial: Saviynt’s identity platform and what it means for NHI governance