The Risk Reality of AI Agents in the Enterprise Is an Identity Problem
AI agents are moving from demonstrations into operational workflows, but their risk profile is often discussed as if it were only a model-quality or data-privacy issue. The more immediate challenge is identity. An agent needs authority to read, decide and act, and every one of those permissions creates a non-human identity that must be governed.
The enterprise risk is therefore not limited to whether an agent produces an incorrect answer. It includes whether the agent can reach the wrong system, reuse a credential outside its intended task or trigger a chain of actions that no human can easily reconstruct.
Why conventional controls struggle
Human-centric IAM assumes relatively stable identities, understandable job roles and a visible user at the point of action. Agents operate differently. They may run continuously, scale across environments and pass instructions between services. A single business workflow can involve an orchestration layer, several specialised agents, APIs, service accounts and temporary tokens.
That complexity makes ownership difficult. If an agent sends sensitive data to the wrong destination, responsibility cannot stop at the model. Security teams need to know who deployed it, who approved its capabilities, what policy was active and which machine identity authenticated each step.
The first requirement is complete discovery. Organisations should inventory agent runtimes, API keys, service accounts, workload identities, automation scripts and delegated permissions. Unknown machine identities are not harmless technical debt; they are unmonitored principals with the potential to become persistence mechanisms.
The second requirement is least privilege that understands tasks. An agent that summarises support tickets does not need unrestricted access to customer records. Permissions should be scoped to the specific systems, records and actions required for a defined job, with expiry built in.
The third requirement is runtime evidence. Logs should capture the initiating identity, delegated authority, tools called, data touched and result produced. That evidence supports both incident response and ordinary governance reviews.
A practical operating model
CISOs should treat Agentic Identity as a lifecycle discipline. Before deployment, each agent needs an owner, purpose, risk tier and approval path. During operation, behaviour should be checked against expected patterns, with rapid revocation available when conditions change. After a workflow ends, unused credentials and temporary access should expire automatically.
This approach connects NHI security to existing IAM investments while recognising that machine speed demands more continuous controls. The organisations that manage agent risk well will not be those that ban autonomy; they will be those that make every autonomous action attributable, bounded and reversible.