Topic starter
15/08/2026 6:10 pm
TL;DR: Privileged access management is shifting from vaulting and session recording to runtime control, as Britive argues that cloud ephemerality, non-human identities, and AI agents have broken the old admin-account model. The decisive issue is no longer who can log in, but whether privilege can be created, scoped, and revoked at execution time.
Editorial analysis by NHI Mgmt Group, based on content published by Britive: “PAM as the Control Plane: Evaluating the Evolution of the PAM Market”.
By the numbers:
- Only 44% of organisations are currently using a dedicated secrets management system, according to the 2024 State of Secrets Management Survey.
Key questions
Q: What breaks when privileged access is bundled into everyday user accounts?
A: Auditability, separation of duties, and blast-radius control all weaken when standard and privileged access are merged.
Q: Why do non-human identities make privileged access governance harder?
A: NHIs scale faster than human accounts and are often created for automation, integrations, and AI agents, which makes them easy to forget and hard to review.
Q: What are the signs that PAM is failing as a runtime control?
A: PAM is failing as a runtime control when access still exists before a task begins, remains after the task ends, or has to be manually cleaned up after privileged operations.
Practitioner guidance
- Map privileged actions to runtime enforcement points Identify where high-impact actions are actually executed in cloud, SaaS, pipeline, and agentic workflows, then place policy at those boundaries instead of only at account creation or credential storage.
- Separate NHI privilege from human admin governance Create a distinct inventory of service accounts, API keys, tokens, and certificates that can perform privileged actions, and apply lifecycle ownership that is separate from human administrative access reviews.
- Reduce standing privilege in execution paths Replace persistent elevated access with task-scoped privilege where the actor receives only the permissions needed for the specific operation and loses them automatically after completion.
Bottom line: The article's core warning is that PAM built for static admin accounts does not match how privilege is now exercised across non-human identities, automation, and AI agents.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
15/08/2026 6:18 pm
PAM is becoming a runtime control plane because the old privilege model no longer matches how privileged work actually happens. PAM was designed for a world of fixed admin accounts, vaulted credentials, and human-paced approval loops. That assumption breaks when privileged actions are issued through APIs, service accounts, automation, and agentic systems that act continuously. The implication is not that PAM disappears, but that the enforcement point has moved to execution time and identity teams must govern privilege as an operating condition, not a stored entitlement.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams govern AI agents that inherit human access rights?
A: Teams should treat inherited access as temporary and bounded to a specific task, owner, and expiry. The key is to govern the delegation chain, not just the agent itself, because the original human authority can persist far beyond the session that created it. If revocation cannot outrun execution, the governance model is already behind the risk.
👉 Read our full editorial: PAM becomes the control plane for NHI and agentic access