Notifications
Clear all
Topic starter
11/06/2026 11:20 pm
TL;DR: Modern application architecture is shifting toward hybrid cloud, on-prem, and AI-heavy workloads, while the same systems are multiplying service accounts, API keys, and other machine identities, according to Cerbos. The security challenge is no longer just where workloads run, but how identity, authorization, and lifecycle governance keep pace with distributed execution.
NHIMG editorial — based on content published by Cerbos: Building the future of modern application architecture
Questions worth separating out
Q: How should security teams govern workload identity in hybrid cloud environments?
A: Treat workload identity as a first-class control, not a byproduct of deployment.
Q: Why does microservices architecture increase identity risk for IAM teams?
A: Microservices increase the number of principals, credentials, and service-to-service trust relationships that must be controlled.
Q: What should organisations do to avoid authorization lock-in?
A: Keep authorization decisions outside application logic and express them through stable, standards-based interfaces.
Practitioner guidance
- Inventory every non-human principal by execution context Map service accounts, API keys, CI jobs, containers, and AI workloads to the environments where they run, then assign an owner and lifecycle state to each identity.
- Adopt workload federation before expanding multi-cloud execution Use standards-based workload identity so services can authenticate across clouds and on-premises without copied secrets or provider-specific credentials.
- Separate authorization logic from application code Move policy decisions into a dedicated layer and keep application services consuming those decisions through stable interfaces.
What's in the full article
Cerbos' full article covers the operational detail this post intentionally leaves for the source:
- The panel discussion context and speaker-specific commentary on modern application architecture choices.
- The article's practical examples of hybrid cloud, on-premises, and edge deployment trade-offs.
- The discussion of open standards, AuthZEN, and how teams can reduce authorization lock-in in code.
- The extended observations on DevOps role changes, infrastructure as code, and legacy modernisation decisions.
👉 Read Cerbos’ panel discussion on modern application architecture trends and identity →
Workload identity in modern architecture: what IAM teams need now?
Explore further
12/06/2026 7:56 am
Identity is becoming the control plane for modern application architecture. The panel’s core message is that cloud mobility, AI workloads, and platform automation all expand the number of non-human principals that must be governed. Once services, pipelines, and AI systems become interchangeable runtime actors, IAM stops being a user problem and becomes an architecture constraint. The practitioner conclusion is straightforward: treat identity design as part of system design, not as a downstream security add-on.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
- Only 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, which shows how quickly the control model is being rewritten.
A question worth separating out:
Q: How do teams know if their non-human identity model is too complex?
A: A model is too complex when teams cannot name the owner, lifecycle state, and access purpose of each machine identity without manual digging. If revocation is slow, policy is inconsistent, or service dependencies are opaque, the identity layer has outgrown operational control and needs simplification before it scales further.
👉 Read our full editorial: Modern application architecture is pushing identity into every layer
