The growing prominence of agentic AI and machine identity at major security events reflects a shift in how organisations must think about access. AI agents are no longer only experimental assistants. They are beginning to retrieve data, invoke tools and coordinate workflows, which means identity becomes the control plane for deciding what an autonomous system may do.
The problem with treating agents as applications
Traditional IAM can assign permissions to a service account or application registration, but that abstraction hides important differences between an automated job and an AI agent. An agent may interpret instructions, select tools dynamically and chain actions across multiple systems. If every action uses the same broad credential, security teams lose the ability to distinguish legitimate automation from misuse.
The resulting risk is not limited to credential theft. Excessive permissions, ambiguous ownership and weak session boundaries can allow an agent to perform valid operations for an invalid purpose. Non-human identity programmes must therefore govern not only who or what is connecting, but also why the connection is being made.
Identity controls for autonomous activity
Short-lived credentials are a foundational control. They reduce the value of stolen secrets and create a natural boundary around an agent session. However, expiration alone is not enough. The credential should be scoped to the task, tool and data required, with sensitive actions requiring additional approval or policy checks.
Continuous authorisation is equally important. Agentic Identity should be evaluated at runtime using context such as the requesting user, current task, data sensitivity, destination and previous behaviour. This allows a system to permit a low-risk lookup while blocking an unexpected bulk export, even when both actions originate from the same agent.
Organisations also need an audit trail that is understandable to investigators. Logs should connect the human instruction, agent decision, tool invocation, credential and resulting change. Without that chain, incident responders may see a series of technically valid API calls but remain unable to establish accountability.
What security leaders should operationalise
CISOs should start by identifying where AI agents already have access, including unofficial experiments. Establish an owner for every agent identity, define approved tools and create a process for testing prompt manipulation and privilege escalation. Existing machine identity controls can provide a foundation, but they must be extended to capture agent intent and runtime context.
The central lesson emerging from the agentic security discussion is practical: autonomy without identity governance is simply unmonitored privilege at machine speed. NHI security programmes that combine discovery, least privilege and explainable runtime decisions will be better positioned to scale useful agents safely.