The Agent Seat Multiplier: Why a 30,000-Employee Rollout Requires 1.3 Million Identities

A 30,000-employee agent rollout implies roughly 1.35 million non-human identities at the 45-to-1 average ratio cited in a May Cloud Security Alliance whitepaper drawing on Entro Security research, and more than 4.3 million at the 144-to-1 cloud-native ratio. The whitepaper reports 16% of organizations do not track creation of AI-related identities, 51% report no clear ownership of AI identities, only 20% have formal offboarding and API-key revocation processes, and 47% of non-human identities have gone unchanged for more than a year. Okta's March AI Agents at Work 2026 survey of executives in seven countries found 96% confident in their non-human identity and access management while only 34% always apply the same security controls to digital labor as to human workers, and 58% reported an AI-related security incident or close call in the past year.

When Uber took its assistant from a 1,000-person pilot to more than 30,000 employees https://forkast.news/uber-rolls-chatgpt-work-to-all-30000-employees-the-unpriced-labor-benchmark/ , the seat count became the benchmark every later rollout gets measured against. This desk’s coverage at the time called it the unpriced-labor benchmark, because the seats were counted and the work was not. What neither the seat count nor the price sheet captures is the population of machine credentials a rollout that size has to carry, and that is where the procurement conversation is heading next. Here is the arithmetic. Non-human identities, meaning service accounts, API keys, tokens, machine certificates, and the credentials agents hold themselves, outnumber human users by an average of 45 to 1, and by as much as 144 to 1 in cloud-native environments, according to a Cloud Security Alliance whitepaper https://labs.cloudsecurityalliance.org/research/csa-whitepaper-nonhuman-identity-agentic-ai-governance-v1-cs/ published in May that cites Entro Security research for both ratios. Apply the conservative average to Uber’s rollout: 30,000 seats times 45 comes to 1,350,000. Call it 1.3 million. At the cloud-native ratio the same rollout crosses 4.3 million. Nobody has audited that specific deployment; the ratio is doing the projecting, and it should be read that way. The multiplier is still the point. The seat is an invoice line; the identity fleet is the workload. Cisco offers a second worked example from its own August blog https://blogs.cisco.com/news/my-agent-and-the-rise-of-ambient-intelligence-ciscos-next-step-in-enterprise-ai : a super-agent “rolling out to 90,000 employees” and moving work “beyond chat and into supervised autonomous execution.” At the same average ratio, that is roughly 4 million identities. Cisco describes the agent as reaching only approved models, approved systems, and enterprise-appropriate data pathways, and reports that agentic interactions on its platform grew nearly 350% quarter over quarter, which makes this a governance story wearing the costume of a productivity one. The same whitepaper describes what managing that population looks like today: 16% of organizations do not track the creation of AI-related identities at all, 51% report no clear ownership of AI identities, only 20% have formal processes for offboarding and revoking API keys, and 47% of non-human identities have gone unchanged for more than a year. Agents pick up permissions at runtime, so the blast radius grows as the agent works, and multi-agent workflows spawn ephemeral identities whose lifecycles are measured in seconds. The paper also records a Fortune 500 financial institution audit that reportedly found more than 4.2 million non-human identities against roughly 50,000 human accounts, a realized ratio north of 80 to 1. The confidence numbers do not match those gaps. Okta’s vendor-sponsored AI Agents at Work 2026 https://www.okta.com/newsroom/articles/ai-agents-at-work-2026-agentic-enterprise-security/ survey, fielded in March across seven countries, found 96% of executives confident in their organization’s identity and access management for non-human identities, while only 34% say their organization always applies the same security controls to its digital labor force as to its human one. In the same report, 58% of executives describe an AI-related security incident or close call in the past year. None of that replaces what this desk has already established: four of eight tracked platforms https://forkast.news/the-enterprise-agent-price-nobody-will-show-you/ publish no public agent price, and every layer of the stack https://forkast.news/nobody-signs-for-the-loss-every-layer-of-the-agent-stack-has-written-the-risk-to-the-customer/ has written the risk to the customer. Those pieces measured price and liability. The separate question is scale: how many identities a rollout creates, and who still owns them once the pilot ends. The tooling answer already exists; three vendors built it https://forkast.news/the-2-problem-three-vendors-built-agent-identity-governance-almost-nobody-is-using-it/ . The population answer keeps multiplying. Ask the person signing the renewal what the rollout costs and you will get a seat count. Ask the security team what has to be provisioned, rotated, audited, and revoked behind it, and you get a number the contract never mentions. The multiplier is not a line item; it is the part of the rollout nobody agreed to manage.