Governing AI Agents Starts with Governing Their Identities

I made the broad case for agentic security-by-design at PlatformCon Live Day NYC. This is the identity piece, up close.

Over the past several months, I've had versions of the same conversation with CISOs, identity teams, auditors, and risk leaders. The technologies differ, but the question underneath is remarkably consistent:

What does governance look like when the identities we're accountable for aren't people anymore?

At PlatformCon, I argued that securing agentic AI isn't a new discipline — it's security-by-design extended to a new kind of actor, across the whole lifecycle. This piece narrows in on the part that tends to get skipped: identity. Because before you can supervise an agent, measure its risk, or hold anyone accountable for what it did, you have to answer something more basic. Who is this agent, what was it allowed to do, and can you prove what it actually did?

Start with the question that changes

Here's the shift in a single view. Traditional identity governance asks one set of questions. Governing an AI identity asks another.

The left column is the world identity programs were built for: people who log in, do their work, and log out. The right column is the world second line now has to govern — non-human identities that retrieve sensitive information, invoke APIs, coordinate other agents, execute approved actions, and keep operating long after the initiating user has disconnected.

Look closely at what the right column is really asking. It isn't "who has access." It's whether every action can be reconstructed and traced back to a specific decision and an accountable human owner. That's an audit question, not just an access question. And it's the question most AI deployments cannot yet answer.

The good news: most of the controls already exist

One of the biggest misconceptions about AI governance is that it requires an entirely new control set. In reality, the foundations are already in place. Organizations still need identity lifecycle management, least privilege, role-based access control, privileged access management, logging, audit trails, segregation of duties, and periodic access reviews.

What's changed isn't the controls. It's the type of identity they have to govern.

Those controls were designed around people and traditional workloads — a human logs in, performs work, and signs out. A non-human identity behaves differently. It may retrieve data, chain together multiple systems, generate recommendations, take approved actions, and continue running with no human in the loop. The identity may look like a service account, but the operating model has fundamentally changed. Governing it means extending practices second line already trusts, not abandoning them.

The evolution of enterprise identity

It helps to see where AI identities fall in the lineage that identity teams have been managing for years:

Human identities → service accounts → workload identities → API identities → AI assistants → AI agents → multi-agent systems.

Identity governance isn't being replaced. It's expanding to govern a new class of enterprise identity — one that acts under delegated authority and makes decisions of its own. Human accountability doesn't disappear when an agent acts. It extends.

Five questions second line should be asking

As organizations operationalize AI-driven workflows, these are the five questions I'd put in front of any governance team.

1. What evidence should exist for every AI identity? Every AI identity should carry the same governance artifacts second line expects for human and workload identities: documented ownership, a business purpose, provisioning approval, the scope of delegated authority, least-privilege permissions, credential management, logging, monitoring, and periodic review. Governance should be able to show not only what an agent can do, but why it was granted that authority and who approved it.

2. How do we demonstrate least privilege for AI? Least privilege doesn't change because AI is involved. Agents should hold only the permissions their assigned work requires — narrowly scoped identities tied to specific functions, short-lived credentials, clear boundaries, and approval workflows for higher-risk actions. And where an agent genuinely needs broad access to do its job, least privilege gives way to compensating strength elsewhere: stronger detective controls, tighter monitoring, and human oversight of consequential actions. What second line should demand is that the trade-off is deliberate and documented, not accidental.

3. How should we measure AI-related risk? Most boards don't need highly technical AI metrics. They need visibility into governance: how many AI identities are deployed, how many are privileged, how many delegations and policy exceptions exist, how many high-risk agent actions occurred, and how those trends are moving. These fit inside existing enterprise risk reporting rather than requiring a separate AI scorecard.

4. Where are organizations getting this wrong? The recurring failures aren't exotic. Shared credentials. Overly permissive service accounts. Undocumented ownership. Thin logging. AI workflows that quietly inherit a human's excessive permissions. These aren't new security problems — they're familiar identity governance weaknesses showing up in a new class of identity, where the blast radius is larger and harder to trace.

5. How do we maintain accountability? Every AI action should remain traceable to an accountable human owner. Governance should be able to answer who approved the delegation, which identity performed the action, what information was accessed, what decisions were made, and whether those actions complied with policy. AI can automate execution. Accountability should never become anonymous.

Maturity is being able to prove it

The organizations getting this right aren't the ones deploying the most advanced agents. They're the ones who can locate themselves on a clear path — from human credentials, to dedicated workload identities, to delegated AI identities, to continuous monitoring and audit, to enterprise AI governance — and produce evidence at every step.

The bottom line

AI agents are a new class of enterprise identity, but they don't invalidate decades of identity governance experience. You don't need to invent a new discipline. You need to thoughtfully extend the one you already have — the same principles of least privilege, segregation of duties, traceability, auditability, and evidence, applied to identities that now act on their own.

As these capabilities mature, success will come down to a question that sounds simple and rarely is:

Who authorized this agent to act — and can we prove exactly what it did?

That's where AI governance is ultimately headed. Not toward reinventing identity governance, but toward expanding it to include the next generation of enterprise identities.