Topic starter
24/09/2026 1:27 pm
TL;DR: Gartner says machine IAM must move from credential-centric control to identity-centric governance, with workloads and AI agents authenticated as governed identities rather than static secrets, according to Akeyless. The practical shift is structural: enterprise IAM assumptions about stable users, reusable credentials, and review cadences do not fit ephemeral machine actors or autonomous agents.
NHIMG editorial — based on content published by Akeyless: machine IAM shifts security from credentials to governed identity
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
Questions worth separating out
Q: What is the first thing security teams should change in machine IAM programmes?
A: Start by inventorying every non-human identity with a real owner, purpose, and expiry condition.
Q: How should security teams implement zero trust for workloads and AI agents?
A: Start by giving each workload or agent a verifiable runtime identity, then enforce request-level policy and issue short-lived credentials only after the identity and context checks pass.
Q: How do teams know if machine IAM is actually working?
A: Look for whether every machine identity has an accountable owner, a documented purpose, and short-lived access that can be revoked without breaking unrelated services.
Practitioner guidance
- Inventory machine identities by owner and purpose Build a living inventory of workloads, service accounts, AI agents, certificates, and tokens with a named human owner, business purpose, and expiry condition.
- Replace standing machine credentials with ephemeral authority Move from reusable static secrets to short-lived access issued only when policy conditions are met.
- Add runtime oversight for AI agent authority Treat AI agents as high-risk machine identities and verify that their actions stay within the scope of delegated permissions after authentication.
What's in the full article
Akeyless' full analysis covers the operational detail this post intentionally leaves for the source:
- The specific Akeyless control flow for dynamic secrets and short-lived workload access across AWS, Azure, GCP, Kubernetes, and OIDC
- How the platform maps machine identity governance to revocation, audit, and policy enforcement across private connectivity
- The runtime handling approach for AI agents, including intent-aware policy and credential brokerage
- A comparative view of secrets management, certificate lifecycle, key management, and AI agent security in one control plane
👉 Read Akeyless' analysis of machine IAM, workload identity, and AI agent governance →
Machine IAM and AI agents: what identity teams need to change?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
24/09/2026 1:27 pm
Machine IAM is now an identity governance problem, not a secrets problem. The article's central point is that credentials alone do not define machine authority because ownership, purpose, and lifecycle state matter more than the token itself. That is consistent with modern NHI practice, where the governable unit is the workload identity or agent identity rather than the secret in flight. Practitioners should treat machine IAM as a cross-functional identity discipline, not a vault feature.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption.
A question worth separating out:
Q: What should organisations do when AI systems need production access?
A: Treat AI access like any other privileged identity problem and define policy boundaries before granting production permissions. Specify allowed tools, data sources, and actions in enforceable rules, then log every policy decision. That keeps the AI governance discussion tied to access control rather than to abstract oversight language.
👉 Read our full editorial: Machine IAM shifts control from credentials to governed identity
