Recently, I sat in on a conversation among CIOs about “the democratization of agents”: putting large language models directly in employees’ hands, connected to business logic so people could build on top of them. The mood was bullish, CIOs sketching out what their teams could do with agents they trained and managed themselves.
Soon after, I was in a room full of CISOs talking about non-human identity. The contrast was stark: instead of excitement, apprehension; instead of use cases, a long list of risks and mistakes not to repeat.
Eventually, the CISOs turned the question back to me: Manage agent identity largely as we manage human identity, or are the differences fundamental enough to rethink our approach from the ground up?
That moment pointed at something I think a lot of security and business leaders are quietly dealing with. The identity programs most of us have spent years building assume every identity is either a human or a machine. Human identities get a joiner-mover-leaver lifecycle, a manager, a role, a review cycle. Non-human identities get a service account, a defined purpose and, if we’re disciplined, an owner. AI agents don’t sit cleanly in either column.
An agent acts on behalf of a human user, so calling it a human identity doesn’t quite work. In my experience, many organizations start by assigning it permission on behalf of the user who invoked it, which works for short, simple tasks but breaks down as they run longer or touch more systems. The next instinct is a service account, which solves delegation but creates over-permissioning and access that outlives its purpose. A more mature approach is to treat the agent as its own workload identity: short-lived, tightly scoped, ephemeral.
That’s the right target. But even a well-built workload identity assumes predictable behavior. It runs the code it was given, and that’s it. Agents don’t. An agent’s actual access can shift mid-task based on the prompt it received, the tool it decided to call, or the plugin it reached for. It has no fixed job role to provision against, and its lifecycle doesn’t align with the joiner-mover-leaver process built for human identities.
So even the mature version of workload identity gets you only part of the way there.
In many enterprise environments, that’s already a structural problem, not a hypothetical one. Non-human identities already outnumber human ones, and that was true before agents showed up. Cloudflare has reported that automated traffic has overtaken human traffic in requests to the websites on its network, earlier than its own CEO had predicted.
That’s a measure of web requests rather than headcount, but the direction of travel is the same one I see inside the enterprise. Agents bend the curve upward because they can request their own tokens, call other services and spin up activity at machine speed. It gets more complicated once agents delegate to each other, a parent agent handing part of a task to several child agents, each inheriting a slice of permission from the one above it. A few layers deep, that’s a permission chain that may evolve beyond what any individual approver originally contemplated.
This growth is what turns the category problem from an interesting edge case into an operational one. Part of what makes this hard: non-human identities have never felt real to people the way human ones do. A human identity has a face. You can track down the person, ask why they need a given level of access and get a straight answer about their job.
A service account or an agent typically gives you none of that. It’s easy to leave alone until it’s compromised, and then you’re reconstructing what it was for and what it could reach. We tend to underestimate how many of these we have, and we underestimate what they can touch. That’s part of why the category problem went unaddressed for as long as it did. It’s not urgent until you can put a number on it, and the number is growing fast.
One CIO.com contributor recently argued the real question with agents is authority, the judgment an agent is allowed to exercise on the company’s behalf, not just access. I agree, but in my experience, many organizations aren’t yet able to answer the authority question because they’re still working out where these identities fit within existing governance frameworks.
The gap shows up in the same place most times I look for it: governance.
In my experience, the failure point is rarely authentication. Increasingly, security teams have a handle on phishing-resistant multi-factor authentication, least privilege and continuous verification, or at least have them on the roadmap. Governance is the harder capability, and it’s where I see programs stall, and it’s where the category problem actually shows up day to day.
Visibility tells you what access exists. Ownership tells you who to call about it. Governance is what you do with that information, and it’s a different thing entirely: blocking risky access combinations before they’re granted, raising the approval bar automatically when a request is high-risk, catching and unwinding out-of-bounds access without waiting for a quarterly review to surface it.
What I’ve come to believe is that governance lags for reasons that have very little to do with technology. It needs executive backing, agreement across teams that don’t report to you and a willingness to change processes people would rather leave alone. Application owners have their own deadlines, and teams resist central controls that slow them down. You can buy a tool. You can’t buy the alignment, and that’s the part that stalls. Too often, agents make it worse, because they push a flood of identities that don’t fit your existing categories through a governance process that was already your weakest link.
I don’t think waiting for the tooling to mature is an option because the agents are already here. Here’s the order I’d work in.
You’ll notice none of these are agent-specific, and for good reason. The discipline that governs agents is the same discipline that runs the rest of your identity program. Agents just take away the option of putting it off.
For many human identities, or even traditional workflow identities, the governing question has historically been administrative: is this identity who it claims to be, and does it have permission to be here? In many environments, that question has traditionally been evaluated primarily at login, at provisioning, and it holds until the next review. That approach can break down for an agent. Because an agent’s actual access scope can shift dynamically based on the prompt it receives (from a human or another agent), the tools it calls or the plugin it reaches for, knowing it authenticated successfully isn’t enough. That model was built for an identity whose attributes and permissions generally remain stable after authentication.
That’s the piece that has to be new, on top of the workload foundation. Identity governance should likely extend from something checked periodically into something that watches what the identity is doing, in real time, and flags the moment it drifts from what it was built for.
The teams that start building that layer now, while their agent count is manageable, are the ones who won’t be doing it in a hurry later.