Topic starter
24/09/2026 1:27 pm
TL;DR: Akeyless cites Gartner research showing machine IAM is moving from credential-centric control to governing workload and AI agent identities directly, with 47% of organisations still using broad human IAM policies and 58% reporting incidents tied to machine identities. Static secrets no longer match ephemeral actors or autonomous authority.
Editorial analysis by NHI Mgmt Group, based on content published by Akeyless: “Gartner on Machine IAM: Govern the Identity, Not the Credential”.
By the numbers:
- 47% of organizations still attempt to govern machine identities through broad IAM policies designed for human users.
- 58% of surveyed organizations reported cybersecurity incidents involving AI-linked and non-AI machine identities.
- 84% of respondents said their AI agents can access sensitive data.
Key questions
Q: What breaks when machine identities are governed separately from human IAM?
A: Separate governance creates blind spots in entitlement review, revocation, and monitoring.
Q: How should security teams implement zero trust for workloads and AI agents?
A: Start by giving each workload or agent a verifiable runtime identity, then enforce request-level policy and issue short-lived credentials only after the identity and context checks pass.
Q: How do teams know if machine IAM is actually working?
A: Look for whether every machine identity has an accountable owner, a documented purpose, and short-lived access that can be revoked without breaking unrelated services.
Practitioner guidance
- Build a governed inventory of machine identities Record each workload and agent with a unique identifier, human owner, business purpose, permissions, and lifecycle state so access can be tied to accountability.
- Replace static service accounts with ephemeral authority Use managed workload identities and just-in-time credentials where systems support them, and set expiry as the default rather than the exception.
- Classify AI agents as high-risk workloads Register agents separately, assign accountable sponsors, scope permissions tightly, and require session limits and expiring credentials before production use.
Bottom line: Machine IAM is moving from managing credentials to governing the machine identity itself, which changes the control problem for workloads and AI agents.
What's in the full article
Akeyless's full article covers the operational detail this post intentionally leaves for the source:
- Gartner-aligned machine IAM guidance on how to replace human-centric policy patterns with workload identity governance
- A breakdown of how managed workload identities, ephemeral access, and lifecycle context fit together in practice
- Examples of how AI agents are treated as high-risk workloads with scoped permissions and expiring credentials
- The vendor's mapping of machine IAM concepts to its own platform architecture and control plane design
👉 Read Akeyless's analysis of machine IAM for workloads and AI agents →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/09/2026 1:27 pm
Machine IAM is now an identity governance problem, not a secrets problem: the industry keeps overfocusing on credential storage and rotation because that is where the tooling historically sat. That frame breaks as soon as workloads become short-lived and AI agents begin acting as delegated actors with their own purpose and owner. The practical conclusion is that the governed object is the machine identity, not the secret.
A few things that frame the scale:
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: How should organisations secure AI agent transactions when agents can act with delegated authority?
A: Organisations should treat AI agent transactions as governed identity events, not just application calls. The control goal is to bind verified identity, intent, payment credentials, and consent into one auditable transaction unit. That reduces ambiguity about who or what acted, what was approved, and whether the action stayed inside the authorised scope.
👉 Read our full editorial: Machine IAM shifts control from credentials to governed identity