Agentic AI and the Identity Problem

Researching accounts. Building lists. Writing sequences.

There's a better use of your team's time.

Apollo is the AI revenue engine that handles the busywork, so you can stay focused on selling.

Plus, everything you need is in one place:

Stop doing busywork and start building pipeline, faster.

With Apollo — the AI revenue engine powering 4M+ users.

Sign up for free

Each edition delivers one clear, evidence-backed idea you can use. This week: How to govern your AI agents’ identity.

Your newest employee never sleeps, never asks for a raise, and holds roughly five times the permissions of the humans sitting next to them. That employee is an artificial intelligence (AI) agent, and most organizations have no idea how to manage it. A recent quantitative analysis across Google Cloud Identity and Access Management (IAM), the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) framework, and Amazon Web Services (AWS) IAM Access Advisor datasets found that autonomous agents carry an average of 63.7 permissions compared to 11.8 for human users, and that agent identities show the highest network centrality of any principal type in enterprise environments (Abba et al., 2026). The agent is already the most over-privileged identity on your network. You just haven't inventoried it yet.

Traditional IAM was designed for two things: human users authenticating through Open Authorization (OAuth), OpenID Connect (OIDC), or Security Assertion Markup Language (SAML), and static machine identities like service accounts. Neither model fits an agent that reasons, delegates, and shifts persona mid-task (Huang et al., 2026). Peer-reviewed work on agentic identity converges on the same failure modes: ephemeral identity that outruns provisioning workflows, recursive delegation chains that lose accountability, and privilege inheritance that quietly compounds (Pappu et al., 2026). Badawy's Lyapunov-stable governance model showed measurable reductions in privilege escalation risk when authorization was treated as a continuous, feedback-controlled variable rather than a static policy, outperforming role-based access control (RBAC), attribute-based access control (ABAC), and baseline zero-trust in simulation (Badawy, 2026).

The insider-threat literature reinforces the parallel. Tian and colleagues built scenario-oriented detection around three specific patterns: privilege abuse, identity theft, and data leakage (Tian et al., 2025). Those are the same three behaviors researchers now flag in agentic systems. Agents drift, chain permissions across tools, and exfiltrate data through legitimate application programming interface (API) calls that no signature-based control will catch.

Enterprises can afford a persona-aware ABAC prototype with verifiable delegation-chain claims (Ganapathi & Banga, 2026). Small and mid-sized businesses (SMBs) cannot. Most run Microsoft 365, one or two software-as-a-service (SaaS) platforms, and a handful of Zapier automations that already act as low-grade agents. When they layer Copilot, a custom Generative Pre-trained Transformer (GPT), or a Model Context Protocol (MCP)-connected agent on top, the new principal usually inherits a human's token or a broad service-account key. There is no lifecycle, no revocation trigger, no behavioral baseline.

Consider what this looks like in practice. A business owner turns on Microsoft 365 Copilot for the executive team. Copilot now inherits every mailbox, SharePoint site, and OneDrive folder those users can reach — including the Mergers & Acquisitions folder, the payroll spreadsheet, and the shared Human Resources mailbox nobody remembers granting delegate access to five years ago. Or an operations lead wires a Zapier automation into the company's Google Workspace with a service account that holds domain-wide read access, then connects that same automation to a large language model tool. The token that was scoped for one workflow is now the credential for an agent that runs on every incoming message.

English and Van den Berg's readiness study makes the point directly: organizations should maintain agent registries, assign unique agent identities, apply least privilege, and prohibit high-stakes autonomy until assurance evidence is stronger — and most are nowhere near that bar (English & Van den Berg, 2026). An SMB with three information technology (IT) staff and no security information and event management (SIEM) platform cannot detect an agent that starts reading mailboxes it never touched last week.

The map you already have works. The National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and Center for Internet Security (CIS) Controls were written for humans and service accounts, but the five functions apply cleanly to agent identities — and mapping your agent controls back to them is what your cyber insurance carrier, your SOC 2 auditor, and your next enterprise customer are going to ask for. Treat every agent as a named identity subject to the same five NIST CSF and CIS Control disciplines you already apply to humans:

None of this requires a new platform. It requires deciding that the agent is a first-class identity and writing it into the same access review, joiner-mover-leaver, and monitoring processes that already govern your humans.

The agent identity problem is not exotic. It is IAM hygiene applied to a principal that acts faster, holds more permissions, and generates fewer audit tickets than any human ever will. The organizations that get ahead of this will be the ones that stop calling it AI governance and start calling it identity management.

I am always looking for new topics so that AI In Its Place remains relevant for you every week. Feel free to email me with suggestions on future topics: [email protected]

Abba, S. S., Obioha-Val, O. A., Ariyo, A. O., Okunleye, O. J., & Ogunmolu, A. M. (2026). Agentic AI and permission inheritance risks: Rethinking access control in autonomous systems. Journal of Engineering Research and Reports, 28(3), 260–281. https://doi.org/10.9734/jerr/2026/v28i31836

Badawy, W. (2026). Secure identity management and continuous adaptive governance for agentic AI systems: A Lyapunov-stable mean-field framework with game-theoretic authorization. In Proceedings of the 2026 IEEE International Conference on Intelligent Computing and Communications (IICC). IEEE. https://doi.org/10.1109/IICC69623.2026.11582739

English, V., & Van den Berg, M. (2026). Are organisations ready to hand over the keys to agentic AI? International Business Research, 19(4), 58. https://doi.org/10.5539/ibr.v19n4p58

Ganapathi, A., & Banga, D. (2026). Access control mechanisms for agentic AI in multi-tenant cloud environments. In Proceedings of the 2026 IEEE International Conference on AI and Data Analytics (ICAD). IEEE. https://doi.org/10.1109/ICAD69378.2026.11608520

Huang, K., Narajala, V. S., Yeoh, J., Raskar, R., Harkati, Y., Huang, J., Habler, I., & Hughes, C. (2026). A novel zero-trust identity framework for agentic AI: Decentralized authentication and fine-grained access control. In Proceedings of the 2026 International Conference on AI x Data and Knowledge Engineering (AIxDKE). IEEE. https://doi.org/10.1109/AIxDKE67294.2026.00024

Pappu, K., Bhushan, B., & Jaiswal, N. (2026). Future-proofing identity security for agentic AI systems: Design, implementation, and evaluation of an identity fabric. In Proceedings of the 2026 IEEE International Conference on Artificial Intelligence Systems and Emerging Technologies (ICAISET). IEEE. https://doi.org/10.1109/ICAISET66439.2026.11541783

Tian, T., Zhang, C., Jiang, B.-S., Feng, H., & Lu, Z. (2025). Insider threat detection for specific threat scenarios. Cybersecurity, 8, Article 17. https://doi.org/10.1186/s42400-024-00321-w