Topic starter
24/04/2026 12:20 pm
TL;DR: Static, user-centric IAM models miss the application and context behind modern API requests, which becomes a problem as AI and automation increase delegated actions and dynamic behaviour, according to Curity. The practical shift is toward context-aware authorization that treats tokens as carriers of claims, not just credentials.
Editorial analysis by NHI Mgmt Group, based on content published by Curity: “Token Intelligence: Why IAM Needs a New Mental Model”.
Key questions
Q: How should teams implement context-aware authorization in modern apps?
A: Start with RBAC for coarse access, then add ABAC rules for the cases that depend on ownership, department, data sensitivity, or other resource attributes.
Q: Why do static user permissions fail in delegated application workflows?
A: Because the user is not the only actor involved.
Q: Should organisations use just-in-time access for AI model operations?
A: Yes, when access is task-based and the operational workflow can tolerate short-lived credentials.
Practitioner guidance
- Map authorization to application behaviour Document which requests are made by users directly and which are made by applications on their behalf.
- Define the claims APIs actually need Identify the contextual data a backend must evaluate before releasing data, such as application identity, request context, or user identity.
- Move AI workflows to just-in-time access Constrain AI and automation use cases to task-scoped access tokens that expire with the workflow and do not rely on standing privilege for repeated execution.
Bottom line: Static user-centric IAM does not fit API-first architectures because applications, not users alone, make many of the requests that matter.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:56 pm
Static user-centric IAM is no longer the right control model for API-first environments. The article is describing a shift in where the authorization decision actually belongs: not at the human identity alone, but at the application and request boundary. That matters because APIs release data based on context, not just entitlement labels. The practitioner conclusion is that access policy has to follow the request path, not stop at the login event.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between token claims and simple bearer credentials?
A: Bearer credentials prove possession, but claims describe the context the backend can use to make an authorization decision. In modern API architectures, that difference matters because the policy often depends on who is acting, what application is involved, and what request is being made now.
👉 Read our full editorial: Context-aware authorization is replacing static IAM for APIs and AI