Every significant technological shift brings a familiar scenario for security leaders: the business innovates first, and security plays catch-up. This pattern, seen with cloud, SaaS, and DevOps, is now repeating with agentic AI. However, AI agents are not merely another service. They are autonomous digital actors that authenticate, receive permissions, call APIs, write code, trigger workflows, query databases, and take action across production environments. Many are already operating with credentials, API tokens, OAuth grants, and cloud roles that are often uninventoried and ungoverned. This raises fundamental security questions beyond what an AI model can "say": Who is this agent? What are its authorized actions? Who is accountable for its behavior? And crucially, can we revoke or constrain its access when circumstances change? **Agentic AI** has a significant identity problem, and attackers are beginning to exploit it. ## Why Traditional Identity Programs Are Insufficient For years, security teams have meticulously crafted identity programs centered on human users. Employees join, move, and leave; access is reviewed; managers attest to needs; and behavior is monitored against stable baselines. Machine identities, such as service accounts, secrets, certificates, and API keys, strained this model due to their proliferation and frequent overprivilege, but they were largely deterministic. ### The Autonomy Problem AI agents break this deterministic assumption. An agent behaves more like a human, interpreting goals, choosing paths, and acting across systems. Yet, it scales like software and processes at machine speed. Agents can be rapidly created, embedded in SaaS products, copied by developers, delegated permissions by users, and left running long after their initial purpose is served. This combination of autonomy, scale, and decentralization creates a new class of identity risk that traditional models were never designed to handle. ### Least Privilege Doesn't Scale Traditional least privilege principles, which grant minimum static permissions for a role, fall short with agentic AI. An agent's access needs can vary significantly based on its goal, the data involved, the user or system it acts on behalf of, and the environment it interacts with. For example, a support agent summarizing a ticket requires different privileges than one authorized to issue refunds or modify customer records. Similarly, a coding agent in a sandbox needs less access than one that can open pull requests or deploy infrastructure. Agent access should be contextual, intent-based, time-bound, and continuously evaluated—a far cry from how most enterprises operate today. ## The Three Critical Problems ### 1. Visibility Problem Many organizations are grappling with "shadow AI," mirroring the past challenges of shadow IT. Agents are being built by internal teams, quietly integrated into SaaS platforms, run locally on endpoints, or embedded within developer environments. They connect to automation platforms, identity providers, cloud consoles, and ticketing systems. If security teams are unaware of an agent's existence, they cannot secure or govern it. Without knowing which credentials an agent uses, the scope of a potential breach remains unknown. Without mapping an agent to an owner, purpose, and lifecycle, accountability for harmful decisions or attacker abuse becomes impossible. ### 2. Overprivilege Problem During experimentation or rapid deployment, agents are often granted excessive access for convenience. Developers might provide broad API tokens for prototypes, business units might connect agents to SaaS accounts with administrative rights, or application teams might embed secrets into workflows to expedite development. These shortcuts create "identity debt," which agentic AI can accumulate at scale and machine speed, dramatically increasing the attack surface. ### 3. Prompt Injection and Indirect Manipulation When an agent can read untrusted content and also take privileged actions, attackers may not need to compromise traditional accounts. Instead, they can attempt to influence what an overprivileged agent can access through **prompt injection** or other forms of indirect manipulation. Without proper scope boundaries and access controls, this becomes a potent vector for unauthorized actions. ## The Path Forward: Identity-Centric Governance CISOs cannot afford to wait for separate AI security programs to mature in isolation. **Agentic AI** governance must be firmly anchored in identity security. The necessary controls build on foundational principles but must be adapted for autonomous systems. ### Essential Controls for Agent Identity Every agent must possess a distinct identity. Shared accounts and borrowed human credentials are unacceptable. Each agent requires a clear owner, a defined business purpose, an approved scope of action, and a controlled lifecycle. Access must be granted based on specific tasks, not convenience. Privileges should automatically expire when no longer needed, and secrets must be protected, regularly rotated, and removed from locations where agents could expose them. ### Automated Enforcement and Governance Manual reviews are unsustainable given the speed at which agents can be created by developers, business users, and SaaS vendors across the enterprise. Identity governance for agents requires automated discovery of new agents, classification of access, detection of risky paths, policy enforcement, and proactive remediation, rather than relying on periodic reviews. ### Decentralized Control with Centralized Policy Accountability necessitates a shift: security teams cannot be a bottleneck for every agent. A more effective model allows teams to build and adopt agents while enforcing strict guardrails for identity, access, ownership, logging, and revocation. This approach, combining decentralized control with centralized policy, fosters innovation without sacrificing essential governance. ## Learning From Past Technology Waves The adoption of cloud, SaaS, and DevOps all outpaced traditional security models. The organizations that succeeded were not those that resisted these technologies, but those that rebuilt their security controls to align with how the new technologies fundamentally operated. **Agentic AI** demands a similar evolution. Organizations that treat this solely as an "AI security problem" will miss the mark. This is fundamentally an identity problem, requiring an identity-centric solution. ## Reframe the Security Question Security leaders must shift their focus from merely what AI generates to what AI can *do*. The escalating risk today is an autonomous action taken by an identity nobody governed, using access nobody reviewed, towards an outcome nobody intended. This is the core identity problem of **agentic AI**, and it demands immediate attention from CISOs. The time to act is now; delaying implementation of identity-centric **agentic AI** governance will only make regaining control harder.