The most expensive line item in an enterprise AI agent programme is not the model. According to the Cloud Security Alliance's 2026 research on non-human identity governance, 78% of organisations have no documented policy for creating or removing the identities their AI agents run on, and only 20% operate a formal process to revoke an API key when an agent is retired.
That is not a security detail. It is the reason a working pilot stalls in front of a risk committee.
What is a non-human identity?
A non-human identity, or NHI, is any credential that lets software act inside your systems without a person present. Service accounts, API keys, OAuth tokens, certificates, robotic process automation logins and now AI agents all qualify. Each one can read data, call systems and trigger transactions on its own authority.
The distinction that matters for 2026 is authority. A traditional service account executes a fixed script. An AI agent decides what to do next, then uses the same credential to do it.
Why has non-human identity become a board-level issue in 2026?
Because the population exploded before the controls arrived. KPMG's Cybersecurity Considerations 2026 report puts the machine-to-human identity ratio above 80 to 1 in the average enterprise, with raw machine identity counts climbing from roughly 50,000 in 2021 to about 250,000 in 2025 at a typical organisation.
The Cloud Security Alliance's 2026 figures show non-human identities grew 44% between 2024 and 2025 across measured enterprise environments.
Agents accelerate that curve. Gartner projects that 33% of enterprise applications will incorporate agentic AI by 2028, up from less than 1% in 2024. Every one of those agents needs something to authenticate with.
The governance numbers have not moved with the population
--- Only 15% of organisations feel highly confident they can prevent an NHI-based attack, per the Cloud Security Alliance's 2026 whitepaper.
--- 51% report no clear ownership for AI identities.
--- 47% of non-human identities have gone unchanged for more than a year.
--- 16% do not track the creation of AI-related identities at all.
--- A March 2026 Cloud Security Alliance research note with Okta found 92% of organisations say their existing identity and access management tooling cannot manage AI agent identities, and that only 47.1% of an organisation's AI agents are actively monitored or secured.
How does the governance gap actually form?
It forms through a reasonable shortcut. A team building an agent needs access to a CRM, a document store and an email system. Provisioning three properly scoped agent identities takes weeks of internal approval. Reusing a developer's personal token takes an afternoon.
The pilot then works, and the shortcut becomes the architecture.
The result is an agent operating with a named employee's permissions, in a log that attributes every action to that employee. When the risk committee asks who authorised a transaction, the honest answer is that nobody can tell.
This is the same structural problem that makes an agent's tool access hard to control, which is why the MCP gateway control layer and identity governance are usually solved in the same programme, not sequentially.
What does Hong Kong regulation require right now?
Hong Kong has no dedicated AI statute, but the accountability expectations are already explicit. In January 2026 the Privacy Commissioner for Personal Data launched compliance checks on 60 organisations. Results published in May 2026 showed 95% used AI in day-to-day operations and more than half ran three or more AI systems.
The PCPD found no PDPO contraventions but recommended governance structures, privacy impact assessments, AI audits, staff training, incident response plans and specific controls for agentic AI.
In March 2026 the PCPD issued a separate alert on agentic AI, noting that agents may reach local devices, files, emails, credentials, browser contents and external services, and may execute multi-step tasks without real-time user involvement.
For banks the timeline is harder. The Hong Kong Monetary Authority's circular of 9 March 2026 requires boards of authorised institutions to oversee and endorse a formal strategic business plan for technology adoption by 9 September 2026.
Neither regulator asks for an identity inventory by name. Both ask questions that are unanswerable without one.
How do you inventory non-human identities before agents go into production?
Run four passes in order, and treat the exercise as a discovery project rather than an audit. Most organisations find between two and five times the number of active non-human credentials their asset register lists, because the register only captures what was requested through a formal process.
Pass one: enumerate, do not estimate
Pull every service principal, API key, personal access token, OAuth grant and certificate from each identity provider, cloud tenant and major SaaS platform. Export it to one sheet with a creation date and a last-used date.
Pass two: assign a human owner to every row
Not a team. A named person with the authority to approve or revoke. Rows with no owner are the finding, not an inconvenience.
Pass three: classify by blast radius
Sort by what the credential can reach, not by what it currently does. A read-only reporting token that can query the full customer table has the blast radius of the customer table.
Pass four: set an expiry on everything
A credential without an expiry date is a permanent grant. Short-lived, scoped tokens issued at runtime are now the standard pattern for agents precisely because they fail closed.
What does a workable agent identity model look like?
An agent gets its own identity, its own narrowly scoped permissions and a runtime credential that expires in minutes rather than years. The human who triggered the agent remains the delegating party, recorded separately in the log.
Three properties make it auditable.
--- Separation. The agent's identity is never a human's identity. Every action attributes to the agent, with the delegating human named alongside it.
--- Least privilege by task. An agent that reconciles invoices reaches the invoice ledger and nothing else, even if the same platform hosts payroll.
--- Revocability in one step. Retiring an agent means revoking one identity, not hunting for shared keys across four systems.
Vendor tooling caught up during 2026, with enterprise-owned agents now registrable and governable through dedicated agent identity products from the major identity providers. The constraint is rarely the technology. It is deciding who owns the decision.
How do you present this to a board or risk committee?
Translate the identity question into an accountability question, because that is the language a board already uses. A risk committee does not need to understand token exchange. It needs to know who is answerable when software takes an action, and how fast that action can be stopped.
Four numbers carry the conversation, and all four are countable rather than estimated.
--- Total non-human identities, with the share that has a named owner. A single figure like "4,100 credentials, 61% owned" reframes the discussion instantly. It is a control gap, not an IT backlog.
--- Credentials with access to regulated personal data. This is the number that connects directly to PDPO exposure, and the one the Privacy Commissioner's recommended privacy impact assessment will ask about.
--- Median credential age. If half your non-human identities predate your current AI policy, your policy governs almost nothing.
--- Time to revoke. Measured in minutes, not in process steps. If the honest answer is "we would need to check four systems", that is the finding.
Boards approve remediation plans far more readily than they approve capability projects. Presenting identity governance as the control that unlocks the agent roadmap, rather than as an obstacle to it, is usually the difference between a funded programme and a deferred one.
How long does this take, and what does it cost?
The inventory itself is fast. The organisational decisions are what set the timeline. In practice, most Hong Kong mid-market organisations complete discovery in two to four weeks and reach a governed baseline within a quarter, because the technical work is largely export, classify and expire.
The expensive version is the one done later. Retrofitting identity separation into a deployed agent means touching integrations, logging, permissions and often the vendor contract simultaneously, and each of those has its own approval cycle.
There is also a market signal worth quoting upward. Grand View Research values the non-human identity access management market at US$11.14 billion in 2025, projecting US$27.33 billion by 2033 at a compound annual growth rate of 11.9%. Tooling budgets are being built industry-wide on the assumption that this layer becomes mandatory rather than optional.
What that does not buy you is ownership. No product decides which department is accountable for an agent's permissions, and that decision is the one that actually blocks most programmes.
What goes wrong when organisations skip this step?
The programme does not fail loudly. It fails at the approval gate, months after the technology worked.
--- The pilot cannot be promoted. Risk and internal audit will not sign off on an agent acting under a developer's credential, so a working system sits in staging indefinitely.
--- Incident response becomes guesswork. When logs attribute agent activity to a person, containment starts with a forensic question rather than a revocation.
--- Budget gets spent twice. Retrofitting identity separation into a deployed agent costs materially more than designing it in, because integrations, logging and permissions all move at once.
--- The ROI conversation collapses. McKinsey's 2026 State of AI research found only 39% of organisations report any EBIT impact attributable to AI, and that in any given business function no more than 10% are scaling agents. Gartner projects more than 40% of agentic AI projects will be cancelled by 2027, citing unclear ROI and weak governance.
Governance is not the tax on scaling. In 2026 it is the precondition for it, in the same way that testing an AI deployment before launch stopped being optional.
The strategic takeaway
Non-human identity is the boring layer that decides whether your agent programme reaches production. The organisations moving fastest in 2026 are not the ones with the best models. They are the ones who can answer, in one screen, which agents exist, what each can reach, who owns it and how fast it can be switched off.
That answer is buildable in weeks, and it is far cheaper to build before the first agent goes live than after the first audit question.
We understand AI. We understand you. With UD by your side, AI never feels cold. Twenty-eight years of working inside Hong Kong enterprise systems teaches you that the unglamorous layer is usually the one that decides the outcome.
Reviewed by the UD enterprise AI and security team. Sources verified 25 August 2026.
Know where you stand before the first agent goes live
Now that you have the framework, the next step is finding out where your own environment actually sits. We'll walk you through every step, from AI readiness assessment and identity inventory to deployment design and ongoing monitoring, with twenty-eight years of Hong Kong enterprise experience behind every recommendation.
