Topic starter
25/08/2026 6:10 pm
TL;DR: Workforce identity now spans humans, service accounts, and AI agents, while 0.01% of non-human identities control 80% of cloud resources and the average worker holds 96,000 entitlements, according to Veza. The governance problem is no longer visibility alone, but authorization, lifecycle control, and auditability across a sprawl of identities that conventional IAM models were never built to manage.
Editorial analysis by NHI Mgmt Group, based on content published by Veza: “Forrester Recognizes Veza for IGA, ISPM, and NHI/AI Identity Management”.
Key questions
Q: Should organisations use the same controls for humans, NHIs, and AI agents?
A: No. The control family may overlap, but the operating assumptions differ. Human identity controls focus on authentication and user context, while NHIs need lifecycle and credential governance, and AI agents require both NHI controls and runtime oversight for autonomous action. The correct model is shared governance with actor-specific enforcement.
Q: Why does entitlement sprawl create more risk than simple account growth?
A: Account growth is a count problem, but entitlement sprawl is a control problem.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use.
Practitioner guidance
- Define the workforce identity control plane Document which systems are authoritative for identity data, authorization decisions, review evidence, and revocation across humans, NHIs, and AI agents.
- Baseline entitlement concentration Measure where a small number of identities control disproportionately large access surfaces, then rank those identities by business reach and privilege concentration.
- Replace periodic review with continuous evidence Collect access, approval, and revocation evidence continuously so auditors can trace dormant accounts, toxic combinations, and third-party access without spreadsheet reconciliation.
Bottom line: The article frames workforce identity as a control-plane issue because access decisions now span humans, NHIs, and AI agents.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 12 hours ago by NHI Mgmt Group
25/08/2026 6:11 pm
Workforce identity security is now an authorization problem, not an access-login problem. The article is right to move the control plane conversation beyond authentication because modern risk sits in what identities can do after they are accepted. That matters for humans, NHIs, and AI agents alike, but the governance lens is clearest when teams focus on effective permissions, not sign-in events. The implication is that identity programmes must be measured by authorization quality, not login success.
Identity control is moving from periodic governance to continuous enforcement. Security and IAM teams should expect the next phase of workforce identity programmes to be judged on whether they can prove access quality in motion, not after the fact. That is especially true where NHIs and AI agents can accumulate or shed privileges faster than human review cycles can respond.
A question worth separating out:
Q: When should organisations prioritise continuous identity evidence over quarterly access reviews?
A: Prioritise continuous evidence when identities change frequently, access is delegated across cloud and SaaS, or auditors need proof of control operation rather than policy intent. Quarterly reviews can still exist, but they should consume live evidence, not replace it. Continuous control is especially important where NHIs and AI agents can alter access faster than human review cycles.
👉 Read our full editorial: Workforce identity security is becoming an enterprise control plane
This post was modified 12 hours ago by NHI Mgmt Group