Notifications
Clear all
Topic starter
25/08/2026 6:10 pm
TL;DR: Modern identity risk now spans privileged users, non-human identities, data systems, and AI agents across SaaS, cloud, and on-prem, with effective permissions only becoming governable when teams can see blast radius and inherited access, according to Veza. The real shift is away from fragmented controls toward continuous entitlement truth, because least privilege fails when access is distributed faster than reviews can follow.
NHIMG editorial — based on content published by Veza: an analysis of privileged access, NHI management, data system access, and agentic AI security
By the numbers:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- Only 5.7% of organisations have full visibility into their service accounts.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
Questions worth separating out
Q: How should security teams govern effective permissions instead of just assigned roles?
A: Security teams should base reviews on effective permissions, meaning the access an identity can actually exercise after inheritance, federation, and role assumption are applied.
Q: Why do non-human identities increase identity blast radius?
A: Non-human identities often run continuously, hold broad permissions, and connect multiple services at machine speed.
Q: What breaks when AI agents are monitored like ordinary automated jobs?
A: What breaks is the assumption that fixed schedules and static logs are enough.
Practitioner guidance
- Map effective permissions across the identity graph Rebuild access reviews around what identities can actually reach after role assumption, inheritance, and federation are applied.
- Assign owners to every non-human identity Require a named owner, expiration state, and rotation expectation for each service account, token, and workload identity.
- Separate agent access from generic workload access Classify AI agents by runtime decision scope, then constrain their access with time-bound permissions and explicit impersonation tracing.
What's in the full article
Veza's full article covers the operational detail this post intentionally leaves for the source:
- How the Access Graph is used to calculate effective permissions across SaaS, cloud, data, and on-prem systems
- Examples of privileged access monitoring workflows for admins, contractors, guest accounts, and federated identities
- How NHI discovery, owner assignment, credential rotation, and vaulting are implemented in the vendor workflow
- The agentic AI use case and plain-language queries for understanding what agents can do and revoke
👉 Read Veza's analysis of privileged access, NHI governance, and AI agents →
Identity graph governance: what Veza changes for privileged access and AI?
Explore further
25/08/2026 6:11 pm
Effective-permissions truth is now the governing layer, not a reporting enhancement. The article reflects a shift that many identity programmes still underweight: assigned access is only the starting point, while inherited and assumed access define the real control surface. That matters across privileged users, NHIs, and AI agents because all three can hold more power in execution than they appear to hold in policy. Practitioners should treat entitlement truth as the basis for governance, not the output of it.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Why do service accounts and AI agents need different controls from human users?
A: Service accounts and AI agents authenticate and act without the predictable patterns that human identity systems expect. They can operate across runtimes, scale quickly, and carry permissions into automated workflows. That means access decisions should consider workload context, runtime behaviour, and time-bound authority rather than relying only on user-centric IAM patterns.
👉 Read our full editorial: Veza's identity graph reframes privilege, NHI, and agentic AI
