Agents Need Their Own Identity

Traditional identity management systems are built around a few types of identities. Frequently, Identity Governance and Administration (IGA) assumes that an identity is tied to a human user, a service account, or an automated script.

AI agents don't fit neatly into any of these predefined buckets, often operating 24/7 autonomously at machine speed. The gap between these traditional identity management models and AI agents' identity needs introduces significant security or accountability risks.

Where Existing Identity Management Falls Short

Often, organizations and individuals implement agentic identity management based on existing paradigms that don't really work. AI agents could be identified as:

• The User: With impersonation, the AI agent is granted the same set of privileges and access as the user, and logs record the agent's actions as the user's actions. This is problematic because it's difficult or impossible to differentiate between what the user does and what the agent does.
• A Service Account: AI agents can also be deployed using a service account, which is shared across all of the agent's users. This can introduce the confused deputy problem, and it may be impossible to determine which user's prompt resulted in a particular action.
• A Script: Traditional identity management for scripts is based on least privilege and the assumption that behavior and privileges can be defined at deployment. Agents' actions are determined at runtime, creating the potential for the agent to abuse assigned privileges or lack crucial ones.

Delegation Over Impersonation

Delegation is designed as a more secure alternative to impersonation for agentic identity management. It ties the agent's actions to the user without conflating the two. However, while it accurately records who acted, it doesn't inherently limit the agent's privileges.

Under a delegation scheme, the AI agent has a distinct identity and is understood to be taking actions on behalf of a particular user. This differentiates the two in the logs and allows the agent to be assigned a subset of its user's privileges.

Implementing Identity Management for Agentic AI

Agentic identity management is a complex problem because AI agents don't fit neatly into any of the traditional "boxes" that existing identity systems are built around. To manage identity risks, organizations should explicitly include agentic AI in their identity management programs and implement the following best practices:

• Assign each agent its own identity
• Use delegation rather than impersonation
• Scope agent privileges per task and time window
• Don't allow user tokens to be forwarded through tool servers
• Inventory AI agents within the non-human identity (NHI) inventory

RFC 8693 defines the OAuth token exchange standard, including the act claim that is the basis for delegation schemes. OpenID's whitepaper on the subject is also worth a read, as it details the associated hard problems, such as sub-agent delegation chains and browser and computer-use agents.

Educational content, not legal, financial, investment, or professional security advice. Terms