Enterprise identity programs were designed around people, applications, and service accounts. AI agents introduce something harder to classify. They can act for a person, use a workload credential, select tools dynamically, create new tasks for other agents, and continue operating after the human who initiated the workflow is no longer present. That makes the growth of agentic AI as much an identity-management problem as a model-security problem. Organisations need to know not only whether an agent is legitimate, but whose authority it is exercising, which permissions are active for the current task, how long those permissions should last, and how to revoke them without breaking unrelated automation.
The identity population can grow without headcount
A company may add no employees and still create thousands of new security principals through AI adoption. An agent can have its own service identity, delegated OAuth grants, API tokens, tool credentials, and temporary execution identities. Multiple agents can operate for the same employee or business process.
This creates a new kind of identity sprawl. Human identity governance usually has lifecycle anchors such as hiring, role changes, and termination. Agents can be created through code, configuration, SaaS features, low-code platforms, or experimentation by individual teams. Their lifecycle may not align with any HR event.
The result is a population of non-human actors whose permissions can accumulate faster than ownership processes mature. That population needs its own lifecycle controls. Otherwise, ownership and access drift apart.
Agent identity is not the same as user identity
It is tempting to let an agent simply act under the credentials of the user who launched it. That preserves access to the systems the user already needs, but it can also erase an important distinction. A human may be allowed to read a database because they can interpret context and are accountable for the decision. An autonomous process that can make hundreds of queries in seconds should not necessarily inherit the same authority without additional constraints.
A stronger identity model keeps three pieces of context separate: the initiating human, the agent or workload performing the task, and the downstream resource being accessed. Authorisation can then evaluate the relationship between them rather than seeing only a valid user token. This is especially important when one agent delegates to another. Without explicit identity propagation, the downstream system may know which service called it but not which user or original task created the authority chain.
Permission needs to be task-scoped
Least privilege is often implemented as role-based access. Agents make that difficult because their work can vary from task to task. A research agent may need read access to several systems during one workflow and no access to them during the next.
Static roles can therefore become too broad. The safer model is task-scoped authorisation: determine the minimum resources and actions required for this execution, issue short-lived authority, and let it expire when the task is complete. That keeps standing privilege from becoming the default.
That makes the permission boundary more closely match business intent. A support agent asked to summarise a case can read the case but cannot automatically close it. If the task later changes to remediation, the additional authority can require a new policy decision.
The UK and US governments’ 2026 global guidance on AI security emphasises secure design, deployment, and operation across the AI lifecycle rather than treating model protection as an isolated activity. Identity fits naturally into that lifecycle view because agent permissions need to be governed from creation through execution and retirement. Lifecycle governance has to follow those permissions as they change.
AI security has to include credential behaviour
AI security becomes more useful as a concept when it includes the identities and credentials surrounding the model, not only the prompts entering it. A perfectly filtered prompt does not help if the agent runs with an overprivileged service account or stores a reusable token that gives broad access to business systems. Security teams should therefore inventory which credentials agents can access, whether those credentials are shared, their lifetime, which services trust them, and whether downstream logs preserve the agent’s identity rather than only the generic integration account.
This is also where secret-management practices need to evolve. Credentials should not be exposed to the model in plaintext simply because the model needs to choose a tool. The orchestration layer can hold the secret and expose only the authorised capability.
Governance gaps become visible as identity gaps
Recent reporting has examined the gap between enterprise adoption of agentic AI and centralised governance. That gap can be measured concretely through identity questions. Identity data turns that abstract gap into something operational.
How many active agents exist? Which business owner is responsible for each one? Which identities can they assume? Which OAuth grants or API tokens have they accumulated? Which agents have not executed in months but still retain access, and which tools can create additional agents or credentials?
These are not abstract governance questions. They are the same lifecycle controls organisations already apply to privileged users and service accounts, extended to a faster-moving class of software actor. Identity telemetry makes those governance gaps measurable.
Agent ownership needs to be operational
Assigning an owner in a registry is useful, but ownership should create obligations. Someone should be responsible for approving the agent’s purpose, reviewing its permissions, responding when anomalous behaviour is detected, and retiring the identity when the workflow is no longer needed. This matters because automated systems can become orphaned. A team launches an agent for a project, the project ends, and the credentials remain valid because no one owns the clean-up step. The agent may stop running, but its access path still exists.
A mature program should treat inactive authority as risk. If an agent has no recent activity, no active owner, or no current business purpose, its credentials should expire by default rather than remain available indefinitely. Expiration should be the default when ownership or purpose disappears.
Revocation must follow the delegation chain
Human identity systems can disable an account when a user leaves. Agentic systems may require more granular revocation. Security teams need to terminate one task, one agent, one delegated permission, or one downstream credential without disabling the entire user or business service.
That requires a record of how authority was delegated. If agent B received permission from agent A, which was acting for user C, the organisation should be able to identify and revoke that branch of authority without guessing which shared token is involved. This is why short-lived credentials and explicit delegation are more than technical elegance. They make containment possible.
Non-human identity should become a first-class security domain
Organisations have spent years improving workforce identity through MFA, conditional access, privileged-access controls, and lifecycle governance. AI agents create pressure to apply comparable discipline to software actors, but with a more dynamic permission model. The objective is not to force every agent through human-style login. It is to make machine authority explicit, attributable, narrow, temporary, and revocable.
As agentic AI scales, the question “Who has access?” will no longer be answered by an employee directory and a list of service accounts. Security teams will need to understand a changing population of autonomous actors and the authority chains that connect them to people and systems. That identity layer may prove to be one of the most important foundations for enterprise AI security because an agent can only cause as much damage as the authority the surrounding architecture allows it to exercise.
