Machine Identity Management for AI Agents
AI agents need their own identity rules, not borrowed human ones.
An AI agent that authenticates with a stolen customer service token, calls three other agents to complete a refund, and disappears in under a second doesn't fit the identity model built for a person who logs in every morning at nine. Traditional machine identities, service accounts, API keys, bots, are static: created once, given fixed permissions, running on a schedule someone actually wrote down. AI agents break that in kind, not just in degree. They exist for the length of a single task before winding down, pick their next move based on model output rather than a script, and call other agents in trust chains where authority gets passed down at each link. What one of them actually does can drift from what it was authorized to do in ways no policy writer saw coming.
Most agents today authenticate as, or on behalf of, a human user. That means they inherit that person's full permission set and act on it at machine speed, which sounds convenient until you consider that a compromised or misdirected agent now has your access, minus your judgment. Once a chain runs three or four hops deep, figuring out which identity did what and who authorized it gets genuinely murky. An agent has no employment record, though, no manager, no HR file. All the scaffolding human identity management leans on quietly in the background just isn't there for something a script spun up at 2 a.m.
How fast the machine identity population is already outrunning human-scale governance
CyberArk reported in 2025 that machine identities outnumbered human identities 82 to 1 in the average enterprise. In cloud-native environments specifically, Entro Security put that ratio at 92 to 1 in the first half of 2024, rising to 144 to 1 by 2025. A 56% jump in twelve months. An IAM team hired and trained to manage human accounts is now governing a population dozens or hundreds of times larger, with the same headcount and the same tools they had five years ago.
AI agents are the fastest-growing slice of that population. A Gravitee survey found the average organization had roughly 37 agents deployed in late 2025; by April 2026, nearly 38% reported running more than 100. Gartner projects 40% of enterprise applications will embed task-specific AI agents by 2026, up from under 5% in 2025. Call it what it is: a step change, not a gradual climb.
The audit numbers make it concrete. One Fortune 500 financial institution found over 4.2 million non-human identities against roughly 50,000 human user accounts, something like 84 to 1 inside a single company. Periodic access reviews, manual offboarding, ticket-based provisioning, the whole apparatus built for human-scale populations, cannot function at that volume. Hiring three more analysts won't fix this. A different tool is needed, not a bigger version of the old one.
What OAuth, SAML, and legacy IAM were actually built for — and where they stop working
OAuth and SAML both assume the same shape: a person logs in, gets handed a bounded token, and the session ends when they walk away from the keyboard. The identity lifecycle maps to a workday. That held up fine for two decades of web apps and single sign-on. It falls apart the moment the thing authenticating isn't a person.
Start with scope. OAuth grants tend to be coarse: read or write on a resource, not "read only this one customer record, for this one task, then forget it." Timing is worse. An agent might exist for a few seconds while OAuth token lifecycles run hours or days. Multi-hop delegation is worse still: neither OAuth nor SAML has any native way to say "Agent A delegated to Agent B, which delegated to Agent C," while preserving what each hop was actually allowed to do. Neither protocol has any concept of intent, either. Authorization is binary, permitted or not, with no room to ask whether an action actually fits what the agent claims to be doing.
High-profile breaches in this period have repeatedly traced back to unmanaged non-human identities carrying excessive privileges — old credentials nobody was watching, holding more trust than anyone remembered granting them.
OWASP's NHI Top 10, published in 2025, shows this isn't a one-off — the leading risk categories are all failure modes legacy IAM was never built to catch, because it was never built for non-human actors in the first place. Teams aren't misconfiguring OAuth so much as running into its ceiling: OAuth's data model has no field for "task scope," "parent agent," or "session lifetime." You can't misconfigure something that was never designed to hold that information.
The governance gap that has opened while deployments ran ahead of policy
Here's the number that should worry any CISO reading this: per the State of AI Agent Security 2026 report, based on more than 900 executives and technical practitioners, 88% of organizations confirmed or suspected an AI agent security incident in the past year. Only 22% treat AI agents as independent, identity-bearing entities with their own governance. Nearly everyone's getting hit, yet almost nobody's built the thing that would stop it.
The authentication habits underneath that gap are almost quaint. 45.6% of organizations still use shared API keys for agent-to-agent authentication, functionally the same as every employee sharing one login and one password. Monitoring isn't much better: only 9.5% of organizations secure more than 81% of their deployed agents, and mean coverage across the industry sits around 52%. Roughly half of production agents run with nobody watching.
Visibility is the more basic failure underneath the monitoring failure. Cloud Security Alliance found in 2026 that a notable share of organizations don't even track the creation of AI-related identities. Not "govern poorly." They don't track it, full stop. Dormancy compounds the problem: a large share of cloud-based non-human identities in enterprises show no activity across extended windows, yet keep full access permissions the entire time. That's an attack surface that grows on its own, quietly, every quarter, whether anyone's using it or not.
Real-world incidents have shown what that looks like once someone exploits it: a single compromised OAuth token connecting SaaS platforms can cascade across many downstream environments. One credential, many blast radii. Industry surveys have found that the majority of organizations still have no formal policy for creating or retiring AI agent identities. The population doubled while the rulebook stayed blank, and nobody's written the missing pages yet.
What a purpose-built identity framework for AI agents actually requires
Legacy IAM is missing four things, and an agent-native framework has to supply all of them.
First, dynamic provisioning: identities minted just for a specific task, scoped to that task's data and actions, and revoked the moment it's done, not sitting in a vault for six months because nobody remembered to rotate a credential. Second, intent-aware authorization: the system has to evaluate what the agent is trying to do, not just what resource it's knocking on. "Does this action match the declared task?" has to be answerable at runtime, not something a human catches three weeks later in an audit.
Third, trust chain transparency. When Agent A calls Agent B calls Agent C, each hop's delegated scope has to stay intact and auditable the whole way through. Most frameworks lose that information after the first hop, which is exactly where responsibility diffusion starts. Fourth, real-time behavioral enforcement: an anomalous action gets blocked as it happens, not flagged in a report someone reads on Friday. Agents move at machine speed, and a security process built around weekly reviews ends up investigating damage that already happened.
Some early standards work points in the right direction. SPIFFE SVIDs and workload identity federation address workload-level identity, and the Cloud Security Alliance's Agentic AI IAM framework, alongside the OWASP NHI Top 10, gives the clearest published baseline for what agent-specific governance should look like. None of it is finished, but it's the closest thing the industry has to a shared vocabulary right now.
Least privilege gets harder here, not easier. A human's access level stays roughly stable across a workday. An agent's permitted scope should shrink to the exact task, the exact data objects it touches, and the exact duration of the session, nothing borrowed from a sponsoring user's broader profile. The audit trail has to change shape too: it needs the sequence of tool calls, the data objects touched, and the chain of agent-to-agent calls, not just a login timestamp. Human-identity logs were never built to hold that kind of record, because nobody needed them to.
How organizations are approaching agent identity governance today — and what the better approaches have in common
Money is moving fast here. SNS Insider puts the non-human identity management market at roughly $10.84 billion in 2025, growing to $70.63 billion by 2035, a 21.65% compound annual growth rate. AI agent identities are the fastest-growing segment inside that market through 2035, per the same research, so vendor investment is landing right where the risk is piling up.
The organizations doing this well tend to start in the same place: discovery. You can't govern what you haven't found, and shadow agents, the ones employees spin up on their own without telling IT, are a persistent blind spot almost everywhere. A few habits keep showing up after that: separate agent identities from human ones instead of letting agents inherit a sponsoring user's full access, swap static API keys for short-lived, task-scoped tokens that expire without anyone needing to remember, and treat unusual agent behavior (unexpected data access, out-of-scope API calls, sudden privilege escalation) as a live detection signal rather than something you find in next month's log review.
The vendor landscape splits roughly into three lanes. Traditional privileged access management players like BeyondTrust and CyberArk are extending credential vaulting and access controls they've spent years building for human and static machine accounts; their strength is depth on the credential side, though coverage of agent-specific behavior and multi-hop trust chains is still catching up. NHI-native vendors such as Astrix and Entro focus on discovery and secrets hygiene across cloud environments, strong on visibility, lighter on real-time enforcement for agents actually running tasks. The gap the credential-focused tools tend to leave is runtime enforcement combined with an audit trail built for agent chains, covering every agent running in an environment, watching approved AI traffic, catching anomalous behavior and policy violations as they happen, and generating a full record of every action an agent takes.
Industry bodies have begun forming working groups focused on machine and agent identity, which tells you something on its own: the industry has accepted that no existing framework covers this, and interoperability standards are coming whether vendors are ready or not. The approaches actually working share one instinct underneath all the tooling differences. They treat agents as identities in their own right, with a real lifecycle, provisioned, watched, retired on purpose, instead of a workaround bolted onto the human IAM system that was already sitting there.
The practical steps security and identity teams can take now, before standards mature
Start with discovery, because none of this works otherwise. Audit every service account, API key, OAuth application, and bot credential currently running, including the ones employees created without ever looping in IT. Expect to find more than anticipated. Everyone does.
Then classify by risk, not by category. An agent that reads public documentation isn't the same risk as one with write access to a financial system or customer PII. Spend your governance effort where the exposure actually is, not spread evenly across every agent you found.
Kill shared API keys first. With 45.6% of organizations still using them for agent-to-agent authentication, this is the single most fixable acute risk on the table right now; move to per-agent, task-scoped credentials that expire on their own. From there, write an actual lifecycle: who can provision an agent identity and under what approval, what behavioral baseline counts as normal and what deviation triggers review, and automatic revocation tied to the end of a task or project rather than a ticket someone has to remember to file.
Scope permissions to the task, not the sponsoring user. An agent should get exactly what its current job requires, nothing inherited from a human's broader access profile. Insist on audit logs that reflect what agents actually do, tool calls, data objects touched, downstream agent calls, not just a record that something authenticated at 3:47 p.m. When something breaks, that's the difference between handing the incident response team a real record and handing them nothing.
Runtime behavioral monitoring belongs in the same category as a firewall, not a compliance report: a live control that blocks or flags in the moment. By the time a weekly review catches an agent that escalated its own privileges, the damage is already filed and closed. Build this discipline now, before deployments scale further and before a breach forces the conversation. Standards are coming, but they aren't coming fast enough to wait for.
