JumpCloud adds continuous compliance tools for users, devices and AI agents

One set of policies for humans and agents

JumpCloud Inc. says its platform now manages humans, devices and agents together. The company points to a gap in current practice: its Q3 2026 IT Trends Report found that only 21% of organizations have implemented governance controls for non-human identities.

Rahul Kamdar, senior vice president of product at JumpCloud, described the thinking behind the approach. "An AI agent is only as compliant as the person behind it and the device it runs on," he said. He added that when someone changes roles or leaves, their agents' access should update automatically, with a record to prove it.

The company also argues that organizations often use separate tools for identity, device management and compliance. According to JumpCloud, this can leave gaps between systems and force IT teams to collect evidence manually.

Three goals and seven capabilities

JumpCloud frames the release around three aims for busy IT teams:

• See access gaps: identify shadow IT, AI agents and unmanaged devices.
• Keep access secure: manage identities and devices under one set of policies.
• Simplify audits: automate access changes and evidence collection.

The new capabilities listed by the company are:

• Workflows automation: automates lifecycle processes, offboarding and policy remediation across all identities and devices.
• Automated compliance reporting: generates real-time audit reports and continuous logs mapped to regulatory frameworks across users, devices and agents.
• Agentic IAM: provides visibility and lifecycle tracking across agents and non-human identities.
• Risk detection: flags risky sign-ins, non-human behavior and unapproved access changes in real time.
• Continuous audit trails: link every human and non-human action to a verified identity to support SOC 2, ISO 27001, HIPAA and NIS2 audits.
• Device trust: blocks unmanaged or unhealthy devices from accessing company data using supported Conditional Access Policies (CAP).
• Privileged access management (PAM): deploys isolated identities and time-boxed credentials for admins and agents. JumpCloud lists this as coming in December 2026.

What it means for IT teams

The release targets organizations that must prove compliance while AI agents take on work alongside employees. Kamdar said that not everyone doing the work shows up on the org chart anymore, but that all of them need to show up in an audit.

A customer view comes from Matt Lemon, a system administrator at Datafy. He said JumpCloud's centralized identity and MDM solution helps the company meet its SOC 2 requirements by providing identity management on its devices and enabling it to enforce security policies remotely.

For IT and security teams, the pitch is less manual evidence gathering and a single place to track which identities, human or not, have access to what. The source does not give pricing or availability details beyond the December 2026 timing for privileged access management. Further information is available on jumpcloud.com.