A reported SailPoint study says 79% of surveyed enterprises run AI agents in production, while only 2% have deployed purpose-built security for them. If representative of the organisations surveyed, the contrast suggests that adoption is moving faster than governance. For identity governance and administration (IGA), the gap is significant because every agent is a principal with some ability to access data, systems or other services.
Why the gap matters
AI agents can combine automated decision-making with credentials and tool access. They may retrieve files, query business systems, execute actions or invoke other services. When these capabilities are configured with a human user’s broad permissions, a compromised agent or flawed workflow can have consequences beyond the original task. Conventional controls may not clearly identify which agent acted, who approved its access or whether that authority remains necessary.
Purpose-built security is not one product category or a substitute for existing identity controls. It requires the organisation to discover agents, assign ownership, constrain access, monitor behaviour and revoke permissions reliably. Without those basics, enterprises may have production agents that are difficult to inventory and even harder to include in access reviews.
Establishing an agent inventory
Organisations should register agents wherever they are created or deployed, including internally developed systems, vendor platforms and automations assembled by business teams. Each entry should record a responsible owner, business purpose, environment, data sensitivity, connected tools and authentication method. An agent without an accountable sponsor should be treated as an exception that needs resolution.
Identity lifecycle management should cover commissioning, changes and retirement. Teams need a defined process to approve new agents, reassess permissions after material changes and remove credentials when an agent is no longer required. Non-human identities should not rely on indefinite access merely because no employee is available to complete a review.
Control permissions and activity
Least privilege is a useful starting point. Separate permissions by task, limit access to necessary systems and avoid embedding long-lived secrets in prompts, code or configuration. Where an agent acts on behalf of a user, controls should preserve the user’s identity while recording the agent’s own role in each action. High-risk operations can require stronger approval or runtime policy checks.
Access certification must be designed for meaningful review. Owners need understandable descriptions of the agent’s purpose and the resources it can reach. Reviews should include indirect access through tools and delegated credentials, and lead to tracked remediation rather than a simple attestation checkbox.
Monitoring should capture agent identity, owner, request context, resources accessed and consequential actions. These records support anomaly detection and incident response. Revocation tests should confirm that tokens, sessions and downstream permissions actually become unusable.
Security leaders can start by measuring inventory coverage, percentage of agents with named owners, stale credentials, review completion and time to revoke access. Those indicators turn an abstract AI risk into actionable IGA work, helping organisations bring production agents under the same principles of accountability and least privilege applied to people.