Topic starter
15/01/2026 3:32 pm
TL;DR: AI, MCP, and machine identities are pushing organisations toward runtime authorization, faster OAuth controls, and broader use of workload identities, according to Curity. The shift is not just technical, it makes dynamic NHI governance the practical boundary for access decisions in autonomous systems.
Editorial analysis by NHI Mgmt Group, based on content published by Curity: “API Security Trends 2026”.
Key questions
Q: How should security teams implement runtime authorization in identity security programmes?
A: Security teams should move the final allow-or-deny decision out of application code and into a dedicated policy layer that evaluates identity, resource, action, and context at request time.
Q: Why do long-lived secrets create more risk for machine identities?
A: Long-lived secrets turn a one-time exposure into persistent access.
Q: What is the difference between workload identities and client secrets for OAuth access?
A: Workload identities bind access to the running service or workload rather than to a reusable secret that can be copied or reused elsewhere.
Practitioner guidance
- Rebuild access for runtime decisions Move machine access decisions out of manual onboarding flows and into policy that can evaluate trust, context, and scope during execution, especially for AI agents and API clients.
- Reduce dependence on long-lived client secrets Inventory OAuth client credentials, workload identities, and equivalent application secrets, then prioritise the cases where reusable credentials still grant broad or persistent access.
- Adopt token exchange for delegated access Use token exchange and JWT assertion grants where cross-boundary access is needed, so delegated permissions are narrower than the original machine credential.
Bottom line: AI agents and MCP integrations are pushing IAM away from manual approval cycles and toward runtime decisions that can keep pace with machine execution.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
08/10/2026 4:53 pm
Runtime authorisation is becoming the real control plane for machine access. The article is pointing at a structural shift: provisioned access is too slow when AI agents and automated services need to act during execution. That means the control boundary moves from lifecycle setup to policy evaluation at the moment of use. For identity programmes, the decisive question is no longer who was approved, but what can be authorised safely right now.
A few things that frame the scale:
- 71% of organizations use third-party APIs, according to Gartner’s 2024 data.
A question worth separating out:
Q: How do organisations keep least privilege working when permissions change at runtime?
A: They need authorisation signals that reflect current context, not just the role or credential issued at onboarding. When permissions can change because another system event changed trust, least privilege only holds if the policy engine re-evaluates the request before the action is allowed.
👉 Read our full editorial: AI agents, MCP, and machine identities will reshape IAM in 2026