Topic starter
15/01/2026 3:50 pm
TL;DR: Access control now has to govern users, devices, APIs, applications, and AI agents, with authentication and authorization increasingly layered across OAuth 2.0, OpenID Connect, JWTs, and policy engines, according to Curity. The practical issue is that conventional IAM patterns struggle as non-human identities scale and runtime context becomes the deciding factor.
Editorial analysis by NHI Mgmt Group, based on content published by Curity: “What is Access Control?”.
Key questions
A: Start by mapping what is protected, who can act, and which conditions change access.
Q: Why do NHIs make access control harder to govern than human users?
A: NHIs are numerous, highly dynamic, and often tied to automation, which means access changes faster than manual review cycles.
Q: What are the signs that role-based access control is becoming too hard to manage?
A: Common signs include role sprawl, frequent role edits, overallocated permissions, and growing visibility gaps across the identity environment.
Practitioner guidance
- Map every requesting party to an identity type Classify users, service accounts, APIs, applications, and AI agents separately so access policy design reflects how each actor actually requests and uses authority.
- Separate authentication from authorization reviews Check that proof of identity, token issuance, and permission enforcement are independently tested, because a valid token does not guarantee safe access.
- Move high-risk decisions into policy evaluation Use attribute and context signals such as device state, location, and request path for access decisions where RBAC alone cannot express the risk.
Bottom line: Access control is shifting from a login problem to a governance problem that has to cover humans, NHIs, APIs, applications, and AI agents together.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
08/10/2026 5:07 pm
Access control is becoming an identity governance problem, not just an authentication problem. The article shows that modern systems now have to arbitrate access for users, APIs, applications, and AI agents within one decision model. That broadening matters because the risk is no longer limited to login abuse. It is the mismatch between static entitlement models and runtime decision-making across heterogeneous identities. Practitioners should treat access control as governance over requesting parties, not as a point solution for sign-in.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What should security teams do when a token is valid but the request still feels unsafe?
A: Reject the idea that token validity alone is sufficient. Recheck scopes, claims, issuer, expiration, and the current context at the enforcement point, then decide whether the request still fits the intended policy boundary. A valid token should not override a failed authorisation decision.
👉 Read our full editorial: Access control for AI agents and NHIs is becoming a governance problem