Governments are among the largest adopters of autonomous software, and among the least equipped to describe what it is allowed to touch. When public-sector technology leaders ask how to manage identity access for AI agents, the honest starting point is that the answer is not a product category. It is an inventory, a delegated authority model and an audit trail, applied to an entity that behaves more like a colleague than a script.
The scale of the shift is documented. Research from SANS puts 74 percent of organisations deploying AI systems that need credentials and permissions to operate autonomously, frequently against critical systems. Okta’s own survey work puts Identity and Access Management as important to security posture for 85 percent of respondents, up from 79 percent the previous year, with 78 percent naming control of non-human identity access as their primary concern. Public bodies inherit both numbers, with an added complication: their accountability is to citizens rather than to shareholders.
The problem with borrowing a human identity
Most agent deployments today do not have an identity of their own. They inherit a service account, an API key or, more troublingly, the credentials of the human who configured them. That shortcut makes the agent indistinguishable from its sponsor in every log, licence and control that was designed around people. Access reviews certify permissions the reviewer believes belong to a person. Offboarding revokes a person while the agent keeps working. Audit trails record a human action that no human took. None of this is a failure of the agent. It is a failure of the identity model applied to it.
Four controls that actually change outcomes
Distinct identities. Every agent should hold its own credential, issued to a named owner, with a lifecycle that ends when the deployment ends. This is the prerequisite for everything else, because attribution is impossible without it.
Narrow delegation. Where an agent must act on behalf of a user, the correct pattern is a scoped, time-bounded grant that carries the user’s intent rather than a copy of the user’s permissions. Standards work here has advanced, with token exchange and cross-application access profiles giving the agent proof of who it acts for and what it was asked to do, both independently verifiable at the resource.
Runtime authorisation. Static role assignments cannot express context. Public-sector systems in particular need policy that evaluates the action, the data classification, the time and the session before allowing it, so that an agent with a legitimate role cannot read a record it has no business case for at three in the morning.
Boundaries with teeth. Kill switches, spend limits, egress restrictions and human approval gates for irreversible actions. SANS found no single safeguard used by more than 40 percent of organisations, which means most agencies are relying on the agent’s good behaviour rather than on an architectural constraint.
Procurement is where this gets decided
For public bodies, the leverage is the contract. Requiring the vendor to expose agent identity, credential scope, audit events and a documented decommissioning path converts governance from an internal effort into a purchasing condition. That is slower than a pilot and considerably faster than discovering, during an inquiry, that an autonomous process has been acting with an unreviewed administrator credential for eighteen months.