Human-machine identity accountability: what IAM teams need to fix

Human-machine workflows create a distributed identity surface, not a single user record. The article correctly shows that accountability now spans a person, their delegated agents and the systems acting on their behalf. That means the old mental model of one authenticated user producing one auditable action is no longer structurally true. IAM programmes that still treat embedded automation as an extension of the user miss the fact that the machine has its own runtime behaviour and its own blast radius. Practitioner conclusion: govern the workflow as a multi-actor identity chain, not as a single login event.

A few things that frame the scale:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.

A question worth separating out:

Q: How do IAM and PAM controls need to change for autonomous systems?

A: IAM and PAM controls need to account for actor behaviour, not just stored permissions. Autonomous systems may choose the sequence, timing and tools used to complete a task, which means approval models, certification cycles and escalation paths need to be evaluated against runtime decision-making rather than static access grants.

👉 Read our full editorial: Human-machine identity governance is breaking enterprise accountability