IAM Best Practices for AI Agents

Know your agents

Organizations should establish discovery, identification, and lifecycle management for all AI agents interacting with their systems. Each agent should be provisioned as a dedicated identity tied to a verified human or organizational owner and de-provisioned when no longer needed. Understanding the different classes of agents based on interaction method, autonomy, and trust boundary is crucial for applying appropriate IAM strategies. Assigning sponsors or custodians to review and certify agent access helps maintain accountability and governance over time.

Detect agents

IAM systems should be capable of identifying when a session or connection is driven by an AI agent. Detection should combine behavioral and technical signals, such as device telemetry and interaction patterns, to distinguish legitimate agents from human users or malicious automation. Tagging sessions originating from AI agents enables visibility and allows downstream services to apply policy-based controls.

Apply delegation, not impersonation

When AI agents act on behalf of human users, it is crucial to apply delegation mechanisms rather than allowing the agent to impersonate the user. This aligns with the concept of authenticated delegation where a user securely grants limited permissions to an agent. User credentials should not be directly shared with the agent; instead, issue delegated tokens with limited scopes. This ensures that the agent acts within defined boundaries and maintains a clear chain of accountability back to the human principal, while also enabling visibility and monitoring into agents' interactions with systems.

Authenticate humans out-of-band

When AI agents act on behalf of users, the IAM system should prompt the human user for explicit authentication and authorization using out-of-band methods (such as push notifications, QR codes, or other suitable flows). This ensures that human users are not required to provide credentials to the agent and that sensitive operations include real-time human oversight and verified consent.

Authorize agents

AI agents should be authorized based on the principle of least privilege, meaning they should have access only to the specific actions and resources required to perform their delegated tasks. Applying policy-based controls with short-lived tokens or time-bound scopes can further reduce the risk of misuse or compromise. For high-risk operations, explicit approval from the human identity should be required through human-in-the-loop verification.

Verify humans

For sensitive operations attempted by AI agents, organizations should explicitly verify human approval (a.k.a human-in-the-loop). Depending on the use-case and sensitivity, consider using challenges that are more robust to being mimicked by AI (for example, identity proofing with a selfie match is more robust to AI compared to OTP over email). This provides a crucial checkpoint for ensuring that critical actions are reviewed and authorized by a human sponsor or end-user before execution. Logging these verification checkpoints is essential for audit purposes. The authenticated delegation framework supports this by making the human role in agent workflows explicit, allowing for verification of decisions and correction of errors.

Monitor agent activity

Organizations should implement robust monitoring and auditing mechanisms to track AI agent activities. This includes logging agent actions, detecting anomalies in their behavior or access patterns, and tracking the tools and resources each agent access to ensure compliance and visibility across systems. When suspicious or noncompliant behavior is detected, access should be automatically revoked, and affected agents reviewed to confirm remediation and maintain governance integrity.

For more information on identity for AI, including tutorials and reference documents, we invite you to explore our Identity for AI Developer Portal.