Agentic AI has become the identity industry’s favourite framing device, and BeyondTrust’s recent commentary lands on a deliberately unfashionable point: the problem autonomous agents create is not new. It is the same problem privileged access management has wrestled with for two decades, arriving at a much larger scale and a much faster clock. That framing matters, because it changes what security teams should actually do about it.
The problem: agents behave like privileged users, without the accountability
An AI agent that can read a mailbox, query a data warehouse, and trigger a provisioning change is functionally a privileged account. It holds credentials, it authenticates to systems, and it acts on its own schedule. What it does not have is a manager, a joiner-mover-leaver record, a habit of taking leave, or any instinct to stop and ask whether a request is appropriate.
Most organisations have no reliable inventory of these actors. They were created by teams rather than by the identity function, they authenticate with long-lived keys or embedded secrets, and their entitlements were expanded iteratively until the agent could complete its task. That is a familiar pattern with an unfamiliar velocity, because an agent can be replicated in minutes and can invoke tools thousands of times before anyone reviews a log.
Main points
Treat agents as identities with lifecycle, not as code with secrets. The discipline that governs human privileged access, including ownership, approval, periodic review, and revocation, transfers directly. An agent without a named business owner is an orphaned privileged account, and orphaned accounts are what attackers look for first.
Just-in-time beats standing entitlement again. The reason PAM pushed organisations toward short-lived, purpose-bound elevation applies even more strongly to machine callers. If an agent only receives a credential at the moment it needs one, and only for the scope of the task, the value of stealing that credential collapses. Static secrets baked into an agent’s configuration are the modern equivalent of the shared local administrator password.
Session management must cover non-interactive activity. Human privileged sessions are recorded and inspectable. Agent sessions usually are not, partly because there is no screen to record and partly because the volume is enormous. The practical answer is intent logging: what the agent was asked to do, which tools it invoked, and which privileged operations resulted. That record is what turns a suspicious sequence into an actionable finding.
Authorisation latency is the hard engineering constraint. Humans tolerate an approval prompt. Agents generally do not. Privileged account security controls for agentic workloads therefore have to resolve policy in milliseconds, which pushes decisions toward policy engines and short-lived tokens rather than workflow-based approvals. Design the control plane before the agent fleet grows, not after.
The governance gap is organisational, not technical. The teams building agents rarely sit with the IAM team, and both report into different budgets. Until agent registration is a mandatory step in the deployment pipeline, inventory will remain partial. The cheapest intervention is to make credential issuance the gate: no registered owner, no token.
BeyondTrust’s argument that this is an old problem in new packaging is useful precisely because it resists the temptation to buy a new category. The controls that work are the ones already proven for privileged access, extended to a population that never fills in a joiner form. Understanding that continuity is what separates a durable agent identity programme from an expensive pilot.