Gartner issued a warning in May 2026 that reads backwards to most enterprise leaders: applying uniform governance across AI agents is itself a cause of enterprise AI agent failure. The instinct in most boardrooms is the opposite. Standardise the policy, apply it everywhere, declare the risk managed.
That instinct fails because AI agents are not applications. They are identities. They hold credentials, request access, take actions and leave audit trails, and each one carries a different level of consequence. A read-only agent summarising internal policy documents and an agent authorised to move money through your payment gateway cannot share one governance template.
The category that resolves this is non-human identity. It is the fastest-growing gap in enterprise access control, and most Hong Kong organisations have no register of it at all.
What is a non-human identity?
A non-human identity (NHI) is any digital identity that acts inside your systems without a person behind the keyboard. It covers service accounts, API keys, machine certificates, workload identities, bots and, increasingly, autonomous AI agents. Each one authenticates, holds permissions and performs actions attributable to your organisation.
The distinction that matters commercially is agency. A service account executes a fixed, predictable script. An AI agent decides what to do next.
That single difference means an agent's access footprint is not knowable in advance from its code. It has to be governed at the identity layer instead.
Why has agent identity become urgent in 2026?
Because the population exploded before the controls arrived. According to Palo Alto Networks' 2026 Identity Security Landscape report, machine identities now outnumber human identities 109 to 1, up from 82 to 1 a year earlier. Of those 109, roughly 79 are AI agents. The report projects agent identities to grow a further 85% in twelve months.
KPMG's 2026 cybersecurity report puts the ratio at 80 to 1 and names non-human identity a critical CISO priority for the year.
The methodologies differ. The direction does not. Every organisation running AI at any scale has added thousands of credentialled actors that its identity governance process was never designed to see.
Gartner's second prediction is the one that should reach your risk committee: by 2027, 40% of enterprises will demote or decommission autonomous AI agents because of governance gaps discovered only after a production incident. Not before deployment. After.
How is an AI agent identity different from a service account?
A service account has a fixed scope, a predictable call pattern and a static credential that a security team can inventory once. An AI agent has a variable scope, an unpredictable call pattern, and often inherits a human user's permissions at runtime. The audit question changes from "what did this script run" to "why did this agent decide to do that".
Three practical consequences follow.
--- Permission inheritance becomes the risk. An agent acting on behalf of a finance manager can reach everything that manager can reach, which is almost never what the agent needs.
--- Anomaly baselines are harder to set. Unusual behaviour is normal behaviour for a reasoning system, so volume-based alerting produces noise rather than signal.
--- Ownership evaporates. Service accounts belong to a system. Agents get created by business teams inside platforms like Copilot Studio, and nobody in IT knows they exist. This is the same dynamic covered in our guide to shadow AI governance, applied to credentials rather than tools.
What does the MCP 2026-07-28 authorization change mean for enterprises?
The Model Context Protocol released its 2026-07-28 specification on 28 July 2026, and the authorization changes are the part your IT director should read. MCP authorization now aligns with production OAuth 2.0 and OpenID Connect, so agent connectors can integrate with Microsoft Entra ID or Okta without custom workarounds.
Two provisions matter specifically to enterprise buyers.
--- Enterprise-managed authorization. An administrator authorises a connector once at the organisation level, and users inherit access through their existing identity provider groups. Per-user consent prompts disappear, and so does the shadow approval path they created.
--- Identity Assertion JWT Authorization Grant (ID-JAG). During single sign-on, the client exchanges the user's identity token for a grant scoped to one specific target server, using RFC 8693 token exchange. In plain terms: an agent receives a narrow, purpose-bound ticket instead of a broad standing credential.
The specification also adds observability aligned with OpenTelemetry, which is what makes agent activity auditable rather than merely loggable.
Anthropic has confirmed support for the new specification in Claude. The strategic read is straightforward: the tooling to do agent identity properly arrived in July 2026. The excuse that the standards were not ready has expired.
What are the five controls in an agent identity framework?
A workable framework has five controls, each with a named owner and a failure signal you can test for. This is deliberately narrow. Five controls that are actually implemented beat a twenty-page policy that nobody operates.
Control 1 — Registry with a named human owner
Every agent has an entry recording its purpose, its data scope, its business owner and its review date. Owner: the business unit that commissioned the agent, not IT.
Failure signal: you cannot produce the list in under an hour.
Control 2 — Tiered autonomy, not uniform policy
Classify agents by consequence. Tier 1 reads internal documents. Tier 2 writes to internal systems. Tier 3 touches customer data, money or external communications. Controls tighten by tier, which is precisely the graduated approach Gartner says separates surviving projects from cancelled ones.
Failure signal: your policy document treats a meeting-notes agent and a payments agent identically.
Control 3 — Zero standing privilege and just-in-time access
Agents receive scoped, time-bound credentials at the moment of use, not permanent keys. ID-JAG makes this practical where it was previously theoretical.
Failure signal: an agent's API key would still work if the agent were deleted tomorrow.
Control 4 — Secrets vaulting and rotation
Credentials live in a vault with automated rotation, never in a prompt, a configuration file or a spreadsheet. Owner: security operations.
Failure signal: any credential in production has never been rotated.
Control 5 — Behavioural monitoring and a human verification gate
Monitor what the agent does relative to its declared purpose, and require human sign-off for Tier 3 actions. This connects directly to the broader control set in our AI agent governance framework.
Failure signal: nobody would notice for a week if an agent started reading a system outside its scope.
How does this play out in a Hong Kong enterprise?
Consider a 320-person insurance brokerage in Kowloon Bay. Its operations team built a claims-triage agent inside a low-code platform. The agent works well. It also holds a service credential with read access to the entire policy-administration database, because that was the fastest way to make the pilot function.
Under the Personal Data (Privacy) Ordinance, that brokerage is the data user. Data Protection Principle 4 requires all practicable steps to secure personal data against unauthorised access, and the Privacy Commissioner's 2026 compliance checks have specifically examined how organisations control AI systems touching personal data.
The uncomfortable question is not whether the agent is useful. It is whether the brokerage can name the person accountable for that credential, state its scope in writing, and show when it was last rotated.
Three patterns recur across Hong Kong organisations of this size.
--- Professional services firms discover agents holding partner-level access to client matter files, created during a pilot that was never formally closed.
--- Logistics operators find agents with write access to production scheduling systems, authenticating with a shared key distributed across three vendors.
--- Property management groups run tenant-facing assistants that inherit permissions from a facilities account with access to CCTV metadata and resident contact records.
What goes wrong when organisations skip agent identity work?
Five failure patterns account for most of the damage, and all five are visible before an incident if you look for them.
--- The orphaned agent. The employee who built it has left. The credential still works. Nobody can explain what it connects to, so nobody dares switch it off.
--- Privilege inheritance creep. The agent was scoped correctly at launch, then a workflow change gave it a broader service account, and the original scope document was never updated.
--- The audit that cannot answer why. Logs show every action the agent took and none of the reasoning, so a regulator's question about a specific decision has no defensible answer.
--- Uniform policy paralysis. Because one policy has to cover payments agents, it becomes so restrictive that low-risk agents are blocked too, and business teams route around IT entirely.
--- Vendor credential opacity. A third-party AI tool holds a token into your CRM, and your contract does not specify rotation, scope or revocation on termination.
How do you start in the next 30 days?
Discovery first, policy second. Most organisations invert this and write governance for a population they have not counted.
--- Days 1 to 10. Inventory. Query your identity provider for service principals and application registrations created in the last eighteen months. Ask each department head directly which AI tools their team has connected to company systems.
--- Days 11 to 20. Classify into three tiers by consequence. Assign a named human owner to every Tier 2 and Tier 3 entry. Accept that Tier 1 can wait.
--- Days 21 to 30. Remediate the top ten by risk. Rotate the credential, narrow the scope, set a review date. Then take the tier definitions and owner list to your risk committee as the first version of policy.
Thirty days produces a register, an owner map and ten closed gaps. That is a defensible position. A policy document with no inventory behind it is not.
The strategic takeaway
Non-human identity is where AI ambition meets access control reality. The agents are already inside your systems, holding credentials your identity governance process cannot see, and the standards to fix that arrived in July 2026.
The leaders who close this gap will not be the ones who wrote the longest policy. They will be the ones who counted their agents, named an owner for each, and tiered the controls to match the consequence. Gartner's warning about uniform governance is really an argument for precision over comprehensiveness.
Precision takes a partner who has seen the failure patterns before. We understand AI. We understand you. With UD by your side, AI never feels cold.
Reviewed by the UD enterprise AI team.
Where to start
Before you write agent identity policy, find out how ready your organisation actually is. UD's readiness assessment maps your current AI footprint, access exposure and governance gaps against what enterprises your size are running, and we'll walk you through every step, from discovery and tiering to remediation and board reporting. Twenty-eight years of Hong Kong enterprise experience, alongside you the whole way.
