SailPoint’s reported move to fold Entro capabilities into identity security for AI agents illustrates how machine identity is becoming a core IAM concern. The growth of cloud workloads and autonomous software has created identities that do not fit neatly into employee directories, yet those identities can hold significant access to data and infrastructure.
The problem: identity without lifecycle discipline
Non-human identities are frequently created as implementation details. A token is issued to connect two services, a certificate authenticates a workload, or an API key enables an automation. Once the system is running, the original context can disappear. Teams may not know who owns the identity, what it can reach or when it should be removed.
This creates a dangerous combination of high privilege and low visibility. Static credentials can be copied, embedded in code or left active after an application changes. AI agents add another layer because their actions can vary with task, tool and model behaviour.
Consolidating discovery and governance
Identity security platforms can address these gaps by correlating machine identities with workloads, applications, owners and entitlements. Discovery must be continuous because cloud infrastructure and automation pipelines change rapidly. The goal is not merely to count secrets, but to understand the access relationships they create.
Once context is available, organisations can prioritise exposed or unused credentials, replace long-lived secrets with short-lived tokens and assign accountable owners. Governance controls should also support exceptions with an expiry date, rather than allowing temporary access to become permanent.
AI agents require a separate identity model
An AI agent should not inherit an employee’s full authority or hide behind a shared service account. It needs an identifiable owner, declared purpose, approved tools and a record of delegated permissions. Runtime policy can then evaluate whether a requested action is consistent with that identity.
For IAM practitioners, the convergence of machine identity and Agentic Identity means extending access reviews beyond people. Reviewers need evidence of actual use, privilege paths and agent behaviour. Combining those signals can turn NHI security from an inventory exercise into a practical method for reducing the attack surface.