Agentic AI Identity Is the Next Frontier (And Your IAM Stack Isn't Ready)
AI agents now act on behalf of users, call APIs, and chain tools together. They need identities, scopes, and audit trails, and almost no existing IAM stack was designed for them.
For two decades, identity systems assumed two kinds of actors: humans and machines. Humans logged in interactively; machines used service accounts and API keys. AI agents break that model. An agent is neither: it acts on behalf of a human, makes its own decisions, and chains calls across many systems in a single task.
The problem in one sentence
An AI agent needs an identity that is scoped (least privilege per task), delegated (it acts for a user, not as itself), auditable (every action traceable), and revocable (killable the instant it misbehaves). Almost no IAM stack delivers all four for non-human, autonomous actors today.
Why service accounts don't cut it
The instinct is to give each agent a service account. That fails for three reasons:
- Over-broad scope. Service accounts are typically granted standing permissions. An agent that only needs to read one calendar ends up able to read every calendar.
- No delegation context. When an agent acts for a user, the audit log should say so. A shared service account erases the human in the loop.
- Slow revocation. Rotating a service-account credential is a project. Killing a rogue agent needs to be a button.
What good looks like
The emerging pattern borrows from OAuth: short-lived, narrowly scoped tokens minted per task, carrying both the agent's identity and the delegating user's. The Model Context Protocol (MCP) authorization work is pushing in this direction, and a handful of vendors are building non-human identity (NHI) governance specifically for this wave.
Update, October 2026: in August, Okta's Cross App Access was adopted as the official enterprise-managed authorization extension for MCP. What that settles, and what it leaves open, is in Agent identity just got a protocol.
What to do now
- Inventory your agents. You probably have more non-human identities than human ones already. You cannot govern what you cannot see.
- Default to short-lived, scoped tokens. Treat standing agent credentials as tech debt.
- Log the delegation chain. Capture which user an agent acted for, on every call.
Agentic identity is moving from research to production faster than the tooling. The teams that get ahead of it now will avoid the non-human-identity sprawl that already plagues secrets management.
Related on Start with Identity
- BlogGiving AI agents identities: stop lending them yours
Most AI agents in production today run on a borrowed identity: the developer's session or a shared cloud role. October's Copilot CLI and AgentCore research show
- BlogShorter certificate lifetimes: the deadline that matters is March 15, 2027
Public TLS certificates are already capped at 200 days. On March 15, 2027 the cap falls to 100 days, and Chrome's root program stops accepting new public certif
- BlogA CVSS 10.0 bug let one user's Terraform token serve another user's request
HashiCorp's Terraform MCP Server failed to assign unique session identifiers in stateless HTTP mode, so a token supplied by one user could be reused for later r
- CVEFreeIPA idp-add evaluates input before checking the caller's rights
Any authenticated FreeIPA principal could push --organization or --base-url values into an eval() call that ran before the access check, reading the server proc
- CVEKeycloak authorization bypass
Keycloak failed an authorization check, so a caller could reach a resource their role should have blocked. Part of the April 2024 RHSA-2024:1868 set with CVE-20
- CVEKeycloak UMA policy privilege escalation
Keycloak's UMA policy engine checked only the first resource in a request (CWE-266). Additional resources skipped the check. A privilege escalation in user-mana