How should security teams modernise identity governance for hybrid work and AI adoption?

Why This Matters for Security Teams

Hybrid work and AI adoption both expose the same weakness: identity controls that assume a fixed network perimeter or a single administrative plane. Once users, devices, SaaS apps, and AI agents all operate from different contexts, traditional access boundaries become hard to trust and even harder to audit. NIST’s Cybersecurity Framework 2.0 pushes teams toward continuous risk management, which is the right direction for this shift.

The problem is not just access volume. It is access variability. A human working remotely, a vendor connected through OAuth, and an AI workflow making tool calls all need identity decisions that reflect current context, not yesterday’s assumptions. NHIMG research on the Ultimate Guide to NHIs highlights that lifecycle control and visibility are core issues, while the State of Non-Human Identity Security reports that only 1.5 out of 10 organisations are highly confident in securing NHIs. In practice, many security teams discover the gap only after a remote access exception or AI overreach has already expanded into a broader identity incident.

How It Works in Practice

Modern identity governance should move from static entitlements to runtime decisioning. That means the control plane evaluates user, device posture, workload identity, location, and policy together at the moment of access. For people, this often means stronger conditional access, phishing-resistant authentication, and tighter session controls. For AI-enabled workflows, it means giving the system an identity that can be governed like a workload, not like a human employee.

Current guidance suggests pairing Zero Trust Architecture with workload-centric controls. NIST SP 800-207 frames the shift toward continuous verification, while NHI governance expands that model to service accounts, API keys, tokens, and agent identities. The practical pattern is to issue short-lived credentials, rotate secrets aggressively, and remove standing privilege wherever possible. NHIMG’s Top 10 NHI Issues shows why this matters: credential sprawl, poor rotation, and over-privilege remain common root causes of exposure.

• Use one identity plane for human and machine access decisions, but apply different policy logic by actor type.
• Bind access to device trust, session risk, and business context instead of office network location.
• Prefer just-in-time privilege for admin tasks and AI tool use, with automatic expiry and revocation.
• Log every decision with enough context to explain why access was allowed, denied, or narrowed.

For AI systems specifically, identity governance should treat the model or agent as a workload with constrained tools, limited scopes, and real-time policy checks. OWASP and NIST-aligned guidance increasingly points toward policy-as-code and context-aware authorization, but there is no universal standard for this yet. These controls tend to break down when legacy apps require shared accounts or when cloud and endpoint teams enforce separate approval paths because the policy engine cannot see the full request context.

Common Variations and Edge Cases

Tighter identity governance often increases operational friction, requiring organisations to balance user convenience against stronger control and auditability. That tradeoff is especially visible in high-change environments such as engineering teams, incident response, and AI-assisted operations. Security leaders need to decide where friction is acceptable and where automation should absorb it.

For example, contractors may need narrower access windows than employees, but they still require enough flexibility to complete time-boxed work. AI agents may need access to multiple systems, but granting broad standing privilege is risky when behaviour is dynamic and task paths are unpredictable. This is where intent-based authorisation is emerging, yet best practice is evolving rather than settled. NHIMG’s Lifecycle Processes for Managing NHIs is useful for teams formalising onboarding, rotation, revocation, and exception handling across both human and machine identities.

Edge cases also include third-party OAuth apps, shared service accounts, and emergency break-glass access. Those scenarios are often justified operationally, but they should be tracked as exceptions with explicit expiry, owner review, and post-use attestation. As hybrid work and AI adoption expand, governance programs that cannot distinguish durable access from temporary need will keep drifting toward privilege accumulation instead of control.

Related resources from NHI Mgmt Group

• When should security teams treat AI design tooling as an identity governance issue?
• How should security teams evaluate unified identity platforms for governance risk?
• Why does internal AI adoption matter to identity governance?
• How should security teams connect data security posture management to identity governance?