THE IDENTITY GOVERNANCE TRIBUNE

Every access decision carries an implicit assumption: that the identity it was made for will behave the same way tomorrow as it did today. For human identities, that assumption is imperfect but workable. People change roles, leave organizations, and acquire new access, and the governance programs we have built over the past two decades are designed to catch those changes through joiner-mover-leaver workflows, access certifications, and periodic reviews. The system is slow, but the subject is slow, too. The assumption roughly holds.

AI agents break that assumption entirely.

An agent's behavior is not anchored to a role, a manager, or a department. It is anchored to its instructions, its tool access, its memory state, and the models and plugins it calls, all of which can change between the moment a governance decision is made and the moment that decision is next reviewed. The authorization does not expire. The agent does not send a notification. The governance cycle continues on its existing schedule. And in the space between those two clocks, the organization is operating on evidence that no longer describes the entity it was written about.

That gap between the age of the evidence and the reality of the identity is the control problem that traditional IGA was never designed to solve.

WE HIRE PEOPLE OVER MONTHS. WE HIRE AGENTS IN MINUTES.

The speed mismatch is the foundation of the problem. Matt Caulfield, VP of Product for Identity at Cisco, named it precisely: People build trust through a process. We know the same person, or the same company hired us, and that company ran a background check, conducted an interview, and verified our identity at onboarding. None of that exists for agents. We hire people over weeks or months. We hire agents in minutes.

The trust-building process—background checks, interviews, and onboarding verification—is what gives an organization its first and most durable evidence that an access decision is valid. It is the baseline against which all subsequent behavior is measured. When that process is absent, the baseline is absent, too.

The January 2026 survey by the Cloud Security Alliance and Aembit documented exactly how far this extends in practice: 43% of organizations use shared or generic service accounts for AI agents, 31% operate agents under delegated human user identities, and only 36% have established dedicated AI agent identities with their own distinct permission sets. When an agent runs under a shared or delegated identity, its activity cannot be attributed, its baseline cannot be established, and its drift cannot be measured because the organization cannot separate agent behavior from the identity it borrowed.

"We hire people over weeks or months. We hire agents in minutes." — Matt Caulfield, VP of Product, Identity, Cisco

THE AGE OF THE EVIDENCE

The core concept worth naming precisely is this: every access decision is a time-stamped judgment about a specific identity's trustworthiness, scope, and purpose. That judgment does not update automatically. It sits in the access record until the next review cycle gives it a new date.

For human identities, the staleness of that evidence grows slowly. For AI agents, evidence age is a materially different problem. An agent's instruction set can be updated by a developer. Its model can be upgraded silently, without a new deployment. Its plugin access can be expanded. Its memory can accumulate context that alters its decision-making in ways that were not present when the original access decision was made.

The BCG analysis published in September 2026 identified this as the core failure mode: "existing permission models fail for opposite reasons—human controls assume judgment and accountability; application controls assume fixed behavior. Agents have neither of these constraints." An agent that was provisioned to perform a narrow, well-defined task at the time of the original access decision may be a materially different operational entity three months later, with no change visible in the identity record.

An access decision has a shelf life. When the identity being governed can materially change between the moment the decision was made and the moment it is next reviewed, that shelf life shrinks—sometimes to hours, not quarters.

■ BY THE NUMBERS

• 43% — Organizations using shared or generic service accounts for AI agents, making behavioral attribution impossible (CSA / Aembit, Jan. 2026)
• 36% — Organizations with dedicated AI agent identities and distinct permission sets (CSA / Aembit, Jan. 2026)
• 35% — Organizations already running agentic AI in production environments (BCG, Sept. 2026)
• 44% — Organizations planning agentic AI deployments—the governance gap is about to get wider (BCG, Sept. 2026)
• 1 in 3 — Organizations expecting AI agents to hold independent decision rights within three years (BCG, Sept. 2026)
• Tens of thousands — Reported agent security incidents since the Hugging Face breach in July 2026 (Nvidia / The Next Platform, Sept. 2026)

WHAT CHANGES WHEN THE SUBJECT CHANGES

The traditional IGA model is built around a stable subject. The joiner-mover-leaver framework assumes that an identity's changes are discrete, externally triggered events—a hire, a role change, or a termination—and that governance decisions made between those events remain valid. That assumption is what justifies the quarterly or annual review cadence.

AI agents are not stable subjects. Their behavior is a function of their current instruction set, their active tool access, their memory state, and the models they call, all of which operate on independent update schedules that are not connected to any governance workflow. An agent does not submit a role change request when its underlying model is upgraded. It does not trigger a recertification when a new plugin is added to its tool chain.

The CSA Agentic Trust Framework, published in February 2026, reaches the same architectural conclusion: "AI agents that can acquire and exercise credentials across multiple trust domains should be governed by policies that treat each action as a fresh authorization decision rather than assuming that a prior credential grant covers all subsequent behavior." That is not a minor adjustment to existing IGA practice. It is a fundamentally different model of what governance means when the subject is not a stable entity.

THREE MEASURES THAT REPLACE 'REVIEW CADENCE' AS THE GOVERNING CONCEPT

1. Review cadence — Not as a calendar event, but as a maximum acceptable interval between behavioral evidence and the next authorization decision. The question is not "When do we review?" but "How quickly does our review cadence need to run to keep the evidence current enough to be trusted?"

2. Revocation speed — The elapsed time between the moment a governance signal identifies a problem and the moment access is actually constrained. A governance program that detects drift in real time but takes 72 hours to revoke access has a 72-hour window during which the authorization is no longer trustworthy but remains active.

3. Escalation thresholds — The predefined conditions under which an anomaly moves from observation to action. Thresholds that are too high let dangerous drift accumulate. Thresholds that are too low generate noise. Calibrating them requires knowing what normal looks like, which requires the behavioral baseline that 64% of organizations currently do not have for their AI agents.

These three measures together define something that traditional IGA never had to calculate: how long an authorization can still be trusted after it was issued.

WHAT PRACTITIONERS SHOULD FOCUS ON RIGHT NOW

NIST's February 2026 concept paper on AI agent identity proposed the most practical starting point: managing agent identity within enterprise identity systems with the same rigor applied to people. That means an agent needs an owner, a purpose statement, a defined entitlement scope, a behavioral baseline, and a lifecycle that includes termination conditions.

Most organizations cannot produce all five of those elements for their current AI agent deployments. The practical question is which one to start with. The answer, in most governance programs, is ownership. An agent without a named owner has no one accountable for its behavioral baseline, no one responsible for flagging drift, and no one who will notice when the evidence supporting its access decision has expired.

ISACA's 2026 guidance puts it in procedural terms: require periodic security and risk reviews before expanding agent capabilities. That creates a checkpoint between capability expansion and governance validation that currently does not exist in most agentic deployments.

📌 SERIES NOTE — Agentic Identity Governance Architecture

• Part 1 — Issue 7, Oct. 19: The Shelf Life of Trust ← YOU ARE HERE
• Part 2 — Issue 8, Oct. 26: Consequence Mapping: What Is Each Signal Authorized to Trigger?
• Part 3 — Issue 9, Nov. 2: The Audit Trail Is the Governance
• Part 4 — Issue 10, Nov. 9: The 40x Gap: The Practitioner Action Plan

📅 MARK YOUR CALENDAR

• Oct. 21, 2026 — Simon Moffatt Webinar: "Cybersecurity Access Control in 2026: Humans, Agents and Hackers" | 2 p.m. ET | Security Today
• Oct. 26, 2026 — Issue 8 of the Identity Governance Tribune: "Consequence Mapping: What Is Each Signal Authorized to Trigger?"
• Oct. 27, 2026 — IDSA + Omada Broadcast: "Identity Hygiene—Making It Harder for Attackers" | idsalliance.org
• Oct. 28, 2026 — Agentic IAM Day 2026 (Virtual Summit) | PlainID | CISOs + IAM leaders governing autonomous agents
•