India's AI workforce is growing overnight, governance is not

Artificial Intelligence (AI) has become a part of almost every major economy in the world, and India is no exception. The mandate from business leaders is clear: To remain competitive, immediate AI adoption is a must. Yet 46% of Indian organisations have already experienced delayed AI initiatives due to identity friction - the highest figure recorded globally. The pressure to deploy is immense, and it is outpacing the discipline needed to deploy safely.

For enterprises across major cities, AI agents are no longer a future ambition. They are being woven into day-to-day operations. Meanwhile, human hiring remains subject to rigorous controls: background checks, offer letters, EPFO onboarding, role definitions, and clear reporting lines. That contrast matters more than most CIOs are willing to admit.

When a new employee joins an organisation, a structured process kicks in before they even log into the company system. Contracts are executed, a manager is assigned, and access is provisioned through IT. Someone is accountable for what that person does and what data they can see. In India's heavily regulated sectors like BFSI, pharma, and IT services, that accountability trail is not optional.

Now imagine hiring hundreds of new workers overnight. No contracts. No managers. No clear record of what they can access or what decisions they are permitted to make, yet they are operating inside systems, moving sensitive data, and acting on an organisation's behalf. That is precisely how many Indian enterprises are deploying AI agents today.

The compliance gap no one is talking about

India's regulatory environment is tightening rapidly. The cost of an untraceable decision is not just operational, it is legal and reputational. Indian organisations already report the highest business impact from identity challenges globally, a clear signal that security teams have yet to institute the modern controls needed to maintain governance at speed. When something goes wrong, boards and regulators will not ask whether the AI was innovative.

They will ask who approved it, who owns it, and who is accountable.

This is where a quiet but serious governance gap opens, and the data makes it impossible to ignore. A majority (63 percent) of Indian IT decision-makers say that AI-related environments are where identity discovery gaps will persist. The problem is not merely theoretical. It is already here, and most organisations know it.

The identity crisis

Traditional identity and access models were built for two types of actors: humans and predictable machines. Agentic AI introduces a new category. Some agents act on behalf of employees, using delegated access to draft emails, generate reports, or interact with enterprise applications.

Others operate independently with their own credentials, autonomously accessing systems and data. In India's IT services and GCC landscape, where AI agents are increasingly embedded into client-facing delivery pipelines, the stakes are particularly high. Both types of agents can trigger real outcomes, yet neither fits neatly into existing governance frameworks.

The response from many organisations has been to compromise on controls rather than slow down deployment. In recent research, 79 percent of Indian organisations reported accepting standing access under operational pressure, and 68 percent said they lack credible alternatives to standing access altogether. When access is permanent and unreviewed, visibility disappears and accountability soon follows.

Governing AI the way HR governs people

India's HR function, especially in large enterprises and IT organisations, has always operated with rigorous lifecycle discipline. AI agents deserve precisely the same rigour.

Before an agent is allowed to operate, organisations need to know it exists. Only 22 percent of Indian organisations report discovering unsanctioned AI consistently, meaning the vast majority have limited visibility into the shadow AI proliferating across their systems. Discovery is the essential first step - the digital equivalent of knowing who is on a payroll.

Onboarding comes next. Just as HR assigns an employee number, job title, and reporting manager, AI agents need unique identities, clearly defined ownership, and explicit permissions. India holds a relative advantage here, leading globally on identity visibility benchmarks, with 40 percent of organisations already using continuous non-human identity (NHI) validation, above the global average.

The challenge is converting that visibility into automated access governance, and too few are making that leap. Access should then be scoped strictly to what the task requires, reviewed regularly, and never granted on a just-in-case basis. And when an agent is retired or abandoned, access must be revoked just as it would be for any departing employee.

The foundation, not the friction

India's ambition to become a global AI powerhouse is well-founded. The talent already exists and the investment is arriving. But adoption without governance is not a competitive advantage, it is a liability in waiting. No responsible organisation would allow a new joiner to wander unsupervised through the office, access sensitive files, and sign documents on the company's behalf. Yet that is effectively what happens when AI agents are deployed without identity, ownership, and accountability structures.

AI agents are joining the Indian workforce whether organisations are ready or not. What is missing is supervision. To turn AI adoption into a genuine competitive edge, Indian organisations must govern their digital workers the same way they govern their human ones. The friction that comes from getting this right is not a constraint on growth. It is the foundation of it.

Anand (Jude) Kannabiran, Vice President, Asia, Delinea