Establish visibility & ownership
Map service accounts, workload identities, service principals and agent use cases. Identify technical owners, business sponsors, dependencies and credential exposure.
05 / NON-HUMAN & AI IDENTITY
Autonomy needs accountability.
Bring machine identities and AI agents into your identity security posture. Connect discovery, ownership and purpose to the credentials, permissions and delegated authority that allow software to act.
Discuss your challengeStart with the context.
Workloads, service principals, API clients and AI agents can hold powerful access without the sign-in signals associated with people. Governance needs to account for how they authenticate, whose authority they use, which tools they can reach and who remains accountable for their actions.
CONTROL IN CONTEXT
More identities. Clearer accountability.
People sponsor software that acts. Ownership, permissions and activity context connect machine and agent identities to accountable decisions.
Named ownershipScoped authorityLifecycle & revocation
HOW WE HELP
From direction to delivery.
Constrain the authority
Review API scopes, tool permissions, delegation, secrets and token lifetime. Assess workload identity federation and short-lived credentials where the environment supports them.
Govern actions & lifecycle
Define creation, approval, periodic review and retirement. Connect agent activity to an accountable sponsor, with escalation, suspension and revocation paths.
THE CONTROL LANDSCAPE
Identity detail. Business context.
Machine identity inventory
Workloads, service accounts, API clients and service principals, tied to purpose and accountable owners.
Credential & permission posture
Secrets, certificates, token lifetime, API scopes and opportunities for federation and least privilege.
Agent authority
Delegated access, tool boundaries and the distinction between an agent’s own identity and a user’s authority.
Lifecycle & accountability
Technical ownership, business sponsorship, review, activity evidence and a clear route to suspend or revoke access.
FURTHER READING
Perspectives that inform the work.
SAILPOINT
Agent adoption is moving faster than governance.
In SailPoint’s enterprise survey, 79% reported AI agents in production, while only 2% reported purpose-built identity security tools to govern and secure them. Safe adoption needs ownership, scoped permissions and a way to revoke authority.
The Horizons of Identity Security · 2026–2027
Explore SailPoint’s identity research ↗ (opens in a new tab)About the research
SailPoint’s 2026 survey of 340 identity, IT, cybersecurity and risk leaders. All organisations had 1,000+ employees. These are two measures from that survey, not an estimate of your environment.
Executive summary, p. 2; research approach, p. 51.
The Horizons of Identity Security · 2026–2027
PALO ALTO NETWORKS · VANSON BOURNE
109:1The identity estate has changed scale.
Palo Alto Networks reports an average of 109 machine identities per human in its 2026 Identity Security Landscape study. Vanson Bourne surveyed 2,930 cybersecurity decision-makers across 20 countries in March–April 2026. The reported average includes AI agents; it is not a target ratio.
2026 Identity Security Landscape · Explore publisher (opens in a new tab)CYBERARK
Application identity and secrets belong together.
CyberArk Conjur’s documentation connects application identity, role-based policy and secure secrets delivery. Machine-identity design needs to account for both the authority to act and the credentials used to exercise it.
Explore CyberArk’s Conjur repository (opens in a new tab)MICROSOFT
Agents need their own control model.
Microsoft’s agent-identity guidance identifies policy mismatch, excessive permissions and lifecycle-accountability gaps. Agent authentication and delegated authority need controls suited to how software acts.
Microsoft Entra agent-identity guidance · 18 May 2026 (opens in a new tab)TECHNOLOGY EXPERIENCE
Technology in context.
Architecture and implementation experience across established identity technologies.
Microsoft Entra
Access, governance & privileged roles
SailPoint
Identity governance
CyberArk
Privileged access & secrets
Okta
Workforce & customer identity
Saviynt
Identity governance & administration
And more. Technology choices follow your requirements, existing estate and delivery priorities.
PRACTICAL OUTPUTS
What we work towards.
- A scoped non-human and AI identity inventory with ownership
- Credential, permission and delegated-authority design principles
- A governance roadmap covering sponsorship, review and revocation
An engagement that fits.
Start with a defined workload, agent use case or identity domain. Scope is based on the systems and evidence available; platform discovery and automation capabilities are assessed rather than assumed.
CONNECTED EXPERTISE