Agentic AI Identity Is the Next Frontier (And Your IAM Stack Isn't Ready)
AI agents now act on behalf of users, call APIs, and chain tools together. They need identities, scopes, and audit trails, and almost no existing IAM stack was designed for them.
For two decades, identity systems assumed two kinds of actors: humans and machines. Humans logged in interactively; machines used service accounts and API keys. AI agents break that model. An agent is neither: it acts on behalf of a human, makes its own decisions, and chains calls across many systems in a single task.
The problem in one sentence
An AI agent needs an identity that is scoped (least privilege per task), delegated (it acts for a user, not as itself), auditable (every action traceable), and revocable (killable the instant it misbehaves). Almost no IAM stack delivers all four for non-human, autonomous actors today.
Why service accounts don't cut it
The instinct is to give each agent a service account. That fails for three reasons:
- Over-broad scope. Service accounts are typically granted standing permissions. An agent that only needs to read one calendar ends up able to read every calendar.
- No delegation context. When an agent acts for a user, the audit log should say so. A shared service account erases the human in the loop.
- Slow revocation. Rotating a service-account credential is a project. Killing a rogue agent needs to be a button.
What good looks like
The emerging pattern borrows from OAuth: short-lived, narrowly scoped tokens minted per task, carrying both the agent's identity and the delegating user's. The Model Context Protocol (MCP) authorization work is pushing in this direction, and a handful of vendors are building non-human identity (NHI) governance specifically for this wave.
Update, October 2026: in August, Okta's Cross App Access was adopted as the official enterprise-managed authorization extension for MCP. What that settles, and what it leaves open, is in Agent identity just got a protocol.
What to do now
- Inventory your agents. You probably have more non-human identities than human ones already. You cannot govern what you cannot see.
- Default to short-lived, scoped tokens. Treat standing agent credentials as tech debt.
- Log the delegation chain. Capture which user an agent acted for, on every call.
Agentic identity is moving from research to production faster than the tooling. The teams that get ahead of it now will avoid the non-human-identity sprawl that already plagues secrets management.
Related on Start with Identity
- BlogA CVSS 10.0 bug let one user's Terraform token serve another user's request
HashiCorp's Terraform MCP Server failed to assign unique session identifiers in stateless HTTP mode, so a token supplied by one user could be reused for later r
- BlogBiometric authentication just became a regulatory frontier
Biometrics are now in nearly every national ID and a growing share of logins, and the law has caught up. BIPA, the EU AI Act, and a wave of US state rules treat
- BlogCertighost lets any domain user forge a Domain Controller certificate
A low-privileged Active Directory account, no admin rights required, can now obtain a certificate for a Domain Controller and DCSync the krbtgt secret. Microsof
- CVEKeycloak authorization bypass
Keycloak failed an authorization check, so a caller could reach a resource their role should have blocked. Part of the April 2024 RHSA-2024:1868 set with CVE-20
- CVEKeycloak UMA policy privilege escalation
Keycloak's UMA policy engine checked only the first resource in a request (CWE-266). Additional resources skipped the check. A privilege escalation in user-mana
- CVESailPoint IdentityIQ role-editing authorization flaw
IdentityIQ failed to authorize role edits on all versions at disclosure (April 2026). Anyone who could reach the role-editing surface could change roles they sh