Should organisations use the same review process for humans and agentic systems?

Why humans and agentic systems need different review models

Human review cycles work because people usually have employment-linked access, predictable managers, and periodic attestation windows. agentic systems are different: their authority can be delegated for a single task, expanded by tooling, and withdrawn as soon as the task ends. That means the real control point is not a quarterly review, but the policy and telemetry around each action.

For human access, the core question is whether the person still needs the access they hold. For agentic systems, the core question is whether the system should be able to act at all, under what conditions, and with what limits on duration, scope, and delegation. A “same review process” approach usually misses the point because the unit of risk is not the account alone, but the action boundary.

This is why a review model built for people can underfit agentic systems even when both use accounts, tokens, or delegated credentials. The access may be valid for seconds, may be chained through other services, and may be exercised without a human present. The governance question is therefore closer to runtime authorisation and containment than to ordinary recertification.

What should be reviewed for agentic systems instead

Agentic systems should be reviewed around the controls that determine what they can do in the moment: who approved the delegation, what task scope was granted, what tools or APIs were reachable, and what conditions trigger step-up approval or termination. That is a different object of review from employment-based access, which is usually stable enough to assess on a schedule.

Good review evidence for agentic systems includes the declared owner, the approved purpose, the current tool surface, the maximum duration of authority, and the safeguards for revocation or containment. If those facts are not visible, a traditional access review will not tell you whether the system is operating within intended bounds. For agentic systems, the review must follow the control plane, not just the account list.

This distinction matters most when agents can act across multiple systems or reuse the same delegated credential across tasks. In that case, a periodic human-style certification can leave standing authority in place long after the original task has changed. The safer pattern is task-scoped access with explicit expiry, plus logging that lets reviewers see what was actually exercised.

How to decide whether one process is enough

Use one process only when the system behaves like a tightly bounded automation with fixed permissions, clear ownership, and no meaningful autonomous decision-making. Once a system can choose actions, invoke tools, or retain access across tasks, it should move to a more frequent and more granular governance model. The higher the autonomy, the less useful a calendar-based review becomes.

For practical governance, separate “can this entity still exist?” from “can this entity still act this way right now?” A human access review answers the first question reasonably well. Agentic governance must answer the second, because risk can appear and disappear inside a single workflow. That is why revocation speed, policy enforcement, and action attribution become more important than annual attestation.

Organisations should also distinguish between identity ownership and behaviour ownership. A manager can often certify a person’s role-based access, but may not be able to judge whether an agent’s tool chain is still safe after a model update, connector change, or workflow redesign. In those cases, the review process needs technical owners who can validate runtime controls, not only business approvers.

Risk and Threat Considerations

Using a human review model for agentic systems creates blind spots around short-lived privilege, delegated authority, and tool reuse. An agent can complete a harmful action, pivot through connected systems, or exfiltrate data before the next review window opens, so the control fails most obviously when access is dynamic and high impact.

Failure mechanism: Periodic recertification checks stale snapshots of access, while the agent’s actual authority is created, used, and retired at runtime. If the review process cannot see task scope, tool permissions, and live revocation state, it will miss the conditions that matter most.

Impact: Excess authority can persist unnoticed, approvals can be bypassed by workflow drift, and incident response may start too late to contain the blast radius. That is especially dangerous when an agent can reach production systems, secrets, or cross-domain APIs.

Practitioner Guidance

What to prioritise: Put runtime authorisation, task expiry, and revocation speed ahead of periodic certification for agentic systems. If a system can take material actions, the review should verify current bounds and current telemetry, not just recorded ownership.

What to verify: Confirm that every agent has a named owner, an explicit task scope, a short-lived authorisation path, and logs that show which actions were actually exercised. If you cannot prove those four items, treat the system as not yet reviewable in the same way as human access.

Decision rule: If the access can outlive the task, do not rely on a human-style review alone; convert the control to continuous or event-driven governance. If the access ends with the task and cannot be reused, a lighter review model may be sufficient.

Practitioner takeaway: The right comparison is not human versus agent, but stable entitlement versus live authority. Human reviews check persistence, while agentic governance must check bounded action.

Related resources from NHI Mgmt Group

• Should organisations use the same process for onboarding people and machine identities?
• Should organisations use the same controls for humans, NHIs, and AI agents?
• Should organisations use the same access model for humans and AI agents?
• Should organisations use the same policy model for humans and non-human identities?