lgkm.org field notes: Identity and access The state of modern IT and security https://lgkm.org/topics/identity/ 2026-10-21T00:00:00Z Simon Bennett Governing AI agents: keep the record, expire the access https://lgkm.org/notes/governing-ai-agents/ 2026-10-21T00:00:00Z Identity governance, access reviews and privileged access management can all cope with AI agents, once each agent is split into a lasting record with a human sponsor and access that is granted for a task and then expires. What that looks like in practice, and why the borrowed login defeats all of it. Identity is the perimeter, so what guards identity? https://lgkm.org/notes/identity-is-the-perimeter/ 2026-10-19T00:00:00Z Once identity decides access, stolen credentials and forgotten accounts become the way in. Guarding identity means phishing-resistant sign-in, owners for every account, and watching sessions, not only logins. Is an AI agent just another non-human identity? https://lgkm.org/notes/is-an-agent-just-another-non-human-identity/ 2026-10-19T00:00:00Z An AI agent is a non-human identity only when it has credentials of its own. If it carries a person's delegated authority or borrows their login, it is something else, and the route decides whether PAM, access reviews and IGA can see it. Machine identities outnumber people; few organisations can list them https://lgkm.org/notes/machine-identities-outnumber-people/ 2026-10-19T00:00:00Z Service accounts, API keys, tokens and certificates now far outnumber staff, and most have no owner and no end date. Start with an inventory that names an owner for each, then shorten how long their secrets live.