AI agent governance is the control of what AI agents can access and act as inside an organisation: which identities they use, which entitlements they hold, and which actions require a human's approval.

An entitlement is a specific capability a system grants (a role, permission level, group membership, or scope), and it is the unit access should be counted, requested, and reviewed in.

Identity governance and administration (IGA) is the discipline of controlling who has access to what across an organisation's systems (granting it, reviewing it, and removing it), with a record of why every grant exists.

Identity lifecycle management is the automation of access through joiner, mover, and leaver events: granting the right access on day one, re-deciding it on role change, and removing all of it on exit.

Identity security posture management (ISPM) is the continuous practice of finding and fixing identity-layer weaknesses (unused access, missing MFA, orphaned accounts, over-broad grants) before they are exploited.

Just-in-time (JIT) access grants a permission only when it is needed and revokes it automatically when the time or task is up, replacing standing access with access that expires on its own.

Least privilege is the principle that every identity, human or machine, should hold only the access its current work requires, and nothing more.

A non-human identity (NHI) is any account or credential that acts without a person behind it (service accounts, API keys, OAuth apps, bots, and AI agents), and that holds access the same way a human does.

An orphaned account is an account whose owner has left, changed role, or (for service accounts) whose responsible human is gone, leaving live credentials that nobody is accountable for.

Privilege creep is the gradual accumulation of access rights an identity no longer needs: the by-product of role changes, projects, and incidents where access was granted but never removed.

Segregation of duties (SoD) is the control that prevents one person from holding combinations of access that let them both commit and conceal an action, such as raising and approving the same payment.

Shadow IT is software adopted inside an organisation without IT or security's knowledge, typically SaaS signed up for with a work email or OAuth grant, creating access and data flows nobody governs.

A user access review is a periodic check in which the right people confirm, grant by grant, that existing access is still needed, and revoke what is not, producing evidence an auditor can rely on.