Human-machine identity accountability: what IAM teams need to fix

Human-machine identity is now a governance model, not a tooling detail: Once software agents can act alongside people, the enterprise no longer has one accountable identity per worker. That changes the unit of control from the person to the human-plus-machine workflow. IAM and IGA programmes that still anchor decisions to a single user record will miss where accountability actually lives. Practitioners need to treat delegated action as a first-class identity event, not an exception.

A question worth separating out:

Q: What should organisations do when an employee leaves but the automation remains?

A: They should retire the machine identity as part of offboarding or workflow change, not leave it running by default. If the automation still needs to exist, reissue it under a fresh ownership decision and a current business purpose.

👉 Read our full editorial: Human-machine identity governance is breaking enterprise accountability