An identity governance model where an agent can choose how to execute identity lifecycle actions against target applications. The core difference from classic IGA is runtime decisioning about mechanism, which makes execution evidence and accountability part of the governance problem, not just policy approval.
Expanded Definition
Agentic IGA is a governance model for identities where an AI or software agent is allowed to choose the execution path for lifecycle actions, such as provisioning, deprovisioning, entitlement changes, or access recertification. In classic IGA, policy decides what should happen; in agentic IGA, the agent also helps decide how it happens across target systems. That makes runtime evidence, tool invocation, and post-action accountability part of the control boundary.
Definitions vary across vendors because some products use “agentic” to mean automation with prompts, while others mean an autonomous agent with execution authority and tool access. For NHI governance, the useful distinction is whether the agent can adapt the mechanism at runtime, rather than simply follow a fixed workflow. This is closely related to the broader agentic application risk landscape described in the OWASP Agentic Applications Top 10 and the control principles in the NIST AI Risk Management Framework.
The most common misapplication is treating agentic IGA as ordinary workflow automation, which occurs when the agent can execute identity changes without separate logging, approval traceability, or tool-specific constraints.
Examples and Use Cases
Implementing agentic IGA rigorously often introduces governance overhead, requiring organisations to weigh execution flexibility against stricter evidence, approval, and containment requirements.
- An agent chooses whether to provision a new joiner through SCIM, direct API calls, or a ticketed connector based on target-system availability, while preserving a complete execution trail.
- An access removal request is approved centrally, but the agent selects the safest deprovisioning sequence across SaaS, cloud IAM, and directory systems to avoid orphaned entitlements.
- A recertification campaign triggers an agent to gather entitlement evidence from multiple applications and flag exceptions for human review when confidence or system state is incomplete.
- An NHI program uses the agent to rotate service-account credentials, but the agent must prove which mechanism was used and which secrets were touched, supporting the analysis patterns discussed in AI LLM hijack breach.
- Security teams compare agent decisioning against the OWASP Top 10 for Agentic Applications 2026 and the Ultimate Guide to NHIs 2025 Outlook and Predictions to decide where autonomy is acceptable.
In practice, the term is most useful where one workflow must span many identity targets and the best execution path depends on live conditions, system trust, or connector health.
Why It Matters in NHI Security
Agentic IGA matters because it expands the governance problem from approval logic to execution control. If an agent can decide mechanism at runtime, then policy alone is insufficient unless the organisation can verify what the agent accessed, what it changed, and whether the chosen path was appropriate. This becomes especially important for secrets, service accounts, and cross-system identity actions, where a single bad execution path can create lingering privilege, credential exposure, or incomplete revocation.
NHIMG research shows why this is now a board-level concern: in SailPoint’s AI Agents: The New Attack Surface report, 80% of organisations said their AI agents had already performed actions beyond intended scope, and only 52% could track and audit the data those agents accessed. That combination of autonomy and weak evidence is exactly where agentic IGA becomes risky. The operational control lesson aligns with the MITRE ATLAS adversarial AI threat matrix and the CSA MAESTRO agentic AI threat modeling framework, both of which emphasise tool-use risk and misuse paths.
Organisations typically encounter the consequences only after an access review fails, a credential is misused, or a deprovisioning gap is discovered during an incident, at which point agentic IGA becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Agentic IGA often depends on secrets and tool access, making improper secret handling a core risk. |
| OWASP Agentic AI Top 10 | A1 | Agentic systems can choose tools and actions at runtime, which is central to this term. |
| NIST AI RMF | Focuses on governing AI risk across design, measurement, and deployment of autonomous systems. |
Constrain agent execution paths and audit secret use whenever identity actions touch credentials or tokens.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on July 5, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
