The Assumptions That Built Modern IAM
Every identity platform you've deployed in the last twenty years was designed around a single, stubborn assumption: the entity requesting access is a person. Not a person using a tool. Not a person approving a workflow. A person who logs in once a morning, does work in predictable bursts, and logs out at some point before their brain turns to mush.
Layered on top of that assumption came a whole apparatus of human-shaped controls: password and MFA policies, session timeouts, role assignments reviewed once or twice a year, joiner-mover-leaver processes triggered by HR events, and behavioral analytics calibrated to the irregularities of human typing, clicking, and sleeping. It was a good fit for humans. It is a surprisingly bad fit for anything else.
That assumption breaks down with AI agents. Agents can act continuously, operate across services, and make decisions within delegated workflows. They don't sleep, they don't forget passwords, and they don't stop mid-task to wait for an access review. Extending human identity controls to these nonhuman actors can obscure ownership, permissions, and accountability instead of solving them.
Why AI Agent Identity Access Management Needs a New Approach
AI agent identity access management must account for identities that are created, delegated, used, and retired differently from human accounts. Treating an agent as a person with a longer-lived session can leave access detached from the context and purpose that justified it.
Traditional controls often center on interactive sign-in, stable roles, and periodic review. Agents may instead invoke tools dynamically and perform multi-step tasks at machine speed. A single user prompt can fan out into a chain of calls across an SaaS suite, a data warehouse, and a handful of APIs — with intermediate identities, service accounts, and credentials involved at each hop. A human-centric model retrofitted with more credentials or extra approval layers can add complexity without making each action more intelligible or constrained.
The scale problem compounds the shape problem. In Astrix Security's 2026 survey of more than 500 IT security leaders and practitioners, 92% of organizations said they already use or plan to use AI agents within the next twelve months, and respondents expected their agent counts to grow roughly fivefold over that period. Nearly four in ten said their teams cannot keep up with the associated risks. Access governance built for headcount growth measured in single-digit percentages per year was never going to absorb a fivefold surge in autonomous, credential-bearing entities.
How Retrofitting Human IAM Can Make Risk Worse
When organizations bolt agent controls onto legacy frameworks, they can end up with unclear ownership, overbroad permissions, and weak visibility into what an agent did on behalf of whom. Persistent credentials may outlive the task or workflow for which they were issued. A human approval at setup time does not, by itself, establish that every later action remains appropriate.
Worse, the retrofit itself becomes an attack surface. Giving an agent a shared service account is the fastest path to "working" integration, and the slowest path to accountability: when ten agents and three automation pipelines all authenticate as the same principal, no log line answers the question that matters — which agent, acting for which human, using whose delegated authority, did this? Adding more identity objects and policy layers on top of that ambiguity creates an appearance of control while leaving the important gaps exactly where they were.
This is why the Dark Reading framing of the problem lands so well: AI agents require a new approach to IAM, not another patch to the old one. The challenge is not simply to authenticate an agent. It is to connect the agent's identity to its owner, purpose, delegated authority, and activity across systems.
A Lifecycle-First Model for Agent Identity
A more useful approach treats agent identity as a lifecycle rather than an account. The vendors building in this space have converged on a recognizably similar shape, often expressed as discover, secure, deploy.
- Discover. Maintain a real-time inventory of AI agents, the tools they can reach, and the underlying non-human identities (NHIs) and credentials they consume — including the growing middle layer of MCP servers that connect agents to enterprise data. An inventory without owner and risk context is just a list.
- Secure. Identify and remediate agents and NHIs with excessive privileges, vulnerable configurations, abnormal activity, and policy violations — applying least privilege continuously rather than at annual review time.
- Deploy. Provision secure-by-design agents from the start: short-lived credentials, just-in-time access scoped precisely to the task, and policy applied at creation rather than retrofitted after the demo went viral. Dedicated agent control planes are emerging specifically to enforce this contract at provisioning time; new vendors are raising significant funding to rebuild identity management for AI agents rather than extend existing directories.
Then the lifecycle keeps going: monitor activity, detect when an agent behaves outside its delegation, and retire credentials when the task or workflow ends. Lifecycle thinking makes identity governance answer practical questions — who authorized the agent, what tools can it reach, what actions are permitted, and how is access revoked when conditions change, instead of simply adding agents to existing user directories and hoping for the best.
The Deployment Reality You're Actually Securing
The identity problem is also an organizational one, because the teams building agents are not the teams who historically requested access. Coding and agent platforms such as Claude Code, Codex, Cursor, Devin, and GitHub Copilot are now embedded in the workflows of security teams, IT and platform engineering, SRE, and site reliability groups, teams that may spin up an agent-employee in a sandbox, or run a fleet of agents for vulnerability triage, cloud incident response, or log analysis, frequently without a formal identity request ever touching a ticketing queue.
The financial-services picture illustrates the stakes: agent-assisted fraud detection, compliance monitoring, underwriting analysis, and client reporting all pull from customer data stores and trading systems. When teams build and scale these agents independently, and even deploy agents that create and manage other agents, the number of high-privilege non-human identities multiplies faster than any human-governed process can track. Delinea frames the resulting requirement as three continuous capabilities across every identity class, human and machine alike: visibility (discover every identity), posture (spot excessive privileges and policy gaps), and control (authorize every identity, session, and action). For agents, "continuous" is not an adjective; it is the entire point. Periodic review of an autonomous system that acts at machine speed is closer to archaeology than governance.
Building the Monitoring Layer Agents Actually Need
Detection for agents looks less like anomalous-login analytics and more like agentic threat detection and response: catching compromised agent credentials, out-of-scope agent actions, and abuse of delegated authority, with the ability to revoke access mid-task. That implies capabilities most IAM stacks do not ship with, non-human ITDR, centralized secret management across vaults and cloud environments, and third-party risk management covering external apps and vendors whose agents touch your environment. Incumbent identity vendors are buying their way toward this layer, with Okta's $200M acquisition of Permiso Security explicitly aimed at watching what AI agents do after login. The move these platforms describe is conceptual as much as technical: from protect-and-control, a static perimeter posture, to adapt-and-defend, where authorization is evaluated against live context because the actor in question has no predictable behavior to baseline in the first place.
From Human-Centric IAM to Identity-Centric AI Governance
AI agents challenge the boundaries between identity management, application security, and governance. Organizations need a clear connection between agent identity and human accountability, while ensuring that permissions remain limited to the work being performed. That makes this a broader identity-centric AI governance problem, ownership, delegation, least privilege, and revocation as one continuous system, not a new authentication feature smuggled into the next IAM release. Security leaders looking for a structured starting point will find a practical framing in the CISO guide to identity-first security for the agentic AI era.
The organizations that get ahead of this will be the ones that treat every agent like an employee that scales infinitely, never sleeps, and does exactly what it was told. The ones that don't will find out what their agents have been doing on behalf of whom, from an audit log, eventually, in an incident report, probably too late.
For related context, see When AI Agents Borrow Human Credentials: The Imperative for AI Cybersecurity Governance and Who Governs the Autopilot? Mitigating Non-Human Identity Sprawl and Image-Based Prompt Injections in Agentic AI.
Sources
- Dark Reading, AI Agents Require a New Approach to IAM
- Astrix Security, Identity Security for AI Agents & Non-Human Identities
- Delinea, Identity Security and PAM Blog
