“Solving the Identity Crisis for AI Agents” captures a problem that is moving from research discussion into everyday engineering. AI agents can plan tasks, call tools and coordinate across services, but their ability to act is often built on credentials designed for simpler automation. The result is a widening gap between agent capability and identity control.
Agents are not ordinary service accounts
A conventional service account generally follows a predictable workflow. An agent can select tools dynamically, interpret changing instructions and create a sequence of actions that was not fully known when access was provisioned. That makes the identity question more demanding: security teams must govern not only who or what is calling an API, but why the call is being made.
Reusing a shared account for an agent also weakens accountability. Logs may show that a technical identity accessed a resource without revealing which agent, task or user initiated the chain. In an incident, that ambiguity slows containment and makes it difficult to distinguish misuse from legitimate automation.
Identity must travel with the task
An effective machine identity model links an agent to its sponsor, purpose, environment and current delegation. Credentials should be scoped to the minimum tools required and issued for limited periods. Each downstream action should preserve enough context to connect the transaction to the originating request.
This is where Agentic Identity becomes distinct from basic authentication. It includes the ability to evaluate an agent’s current behaviour, enforce boundaries between planning and execution, and interrupt an action when risk changes. A well-designed control plane can allow an agent to work quickly while requiring approval for financial, administrative or destructive operations.
Building an operational program
Organizations should begin with discovery. Inventory agents, orchestration platforms, plugins, tokens and service accounts, including those created by development teams outside central IAM. Then assign ownership and define the data and actions each identity is allowed to reach.
Runtime monitoring should look for unusual tool selection, privilege escalation, unexpected geography or access to unrelated systems. Automated revocation and credential rotation are equally important. When an agent is deleted or its sponsoring workflow changes, its machine identity should not remain active as an orphan.