Notifications
Clear all
Topic starter
28/08/2026 12:03 pm
TL;DR: Enterprise identity governance must now cover human users, non-human service accounts, and autonomous AI agents, because periodic access reviews cannot keep pace with access that changes in real time, according to Oleria Security. The core issue is not just scale, but the collapse of assumptions behind legacy IGA when AI-driven identities widen the governance gap daily.
NHIMG editorial — based on content published by Oleria Security: Identity governance in the age of AI and the CEO transition
Questions worth separating out
Q: Should organisations use the same controls for humans, NHIs, and AI agents?
A: No. The control family may overlap, but the operating assumptions differ. Human identity controls focus on authentication and user context, while NHIs need lifecycle and credential governance, and AI agents require both NHI controls and runtime oversight for autonomous action. The correct model is shared governance with actor-specific enforcement.
Q: When should organisations prioritise posture management for NHIs and AI agents?
A: Prioritise it before large-scale deployment, not after incidents or budget reviews.
Q: When should teams move from point-in-time governance to continuous access control?
A: They should move when critical access can change faster than a manual certification cycle can observe.
Practitioner guidance
- Classify identities by actor type first Separate humans, service accounts, and AI agents in the identity catalogue so lifecycle, review, and privilege controls can reflect the subject being governed.
- Replace static certification with event-driven review Trigger access evaluation when entitlements change, credentials rotate, or AI-driven workflows alter scope rather than waiting for quarterly or annual recertification.
- Target standing privilege before broadening scope Map where access persists beyond task completion and reduce it through task-scoped permissions, tighter ownership, and explicit revocation paths.
What's in the full analysis
Oleria Security's full post covers the operational detail this post intentionally leaves for the source:
- The leadership transition context and the company’s positioning on AI-era identity governance.
- The full description of its adaptive governance model across human, non-human, and AI identities.
- The funding and enterprise adoption context behind the company’s current direction.
- The source article’s own framing of why continuous governance differs from periodic certification.
👉 Read Oleria Security's analysis of identity governance in the age of AI →
AI copilot risk and identity governance: what changes for teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
28/08/2026 12:04 pm
Continuous governance is becoming the minimum viable control model for modern identity estates. Periodic certification was built for stable human access, not for environments where NHIs and AI agents can change access state continuously. The governance question is no longer whether access can be reviewed, but whether the programme can observe and act on access before the risk becomes durable. Practitioners should treat static review cycles as incomplete for mixed identity estates.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- A separate finding from the same research shows that lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations.
A question worth separating out:
Q: How should IAM teams govern human, non-human, and AI identities together?
A: Start by separating the identity types in policy, ownership, and review cadence, then define where controls can be shared and where they must remain distinct. Human users, service identities, and AI systems do not fail in the same way, so the governance model has to preserve that difference while still producing one audit trail.
👉 Read our full editorial: Identity governance moves toward AI-era continuous access control
