Key IAM Considerations to Support Agentic AI

Key Challenges

AI agents pose unique IAM challenges:

• Scale & Autonomy: Organizations could see thousands of agents operating independently, requiring controls for on/offboarding and delegated authority.

• Mixed Identities: Agents may act on behalf of a user or as autonomous entities with their own credentials.

• Threat & Detection: Traditional “bot detection” may erroneously block legitimate AI agents, or fail to catch malicious ones.

• Governance & Oversight: Sponsors or custodians must monitor an agent’s behavior, entitlements, and risk posture.

• Consent & Delegation: Over-permissive delegation may expose excessive data; organizations should allow more fine-grained entitlements and require human oversight for sensitive tasks. Insufficiently specific consent or a lack of explicit boundaries on an agent’s permission may result in agents taking actions users did not believe they had authorized, leading to unhappy customers and attempts to roll back transactions initiated by authorized agents (e.g. purchase chargebacks).

What an IAM System Should Support

Looking ahead, organizations should evaluate whether their IAM systems can do the following:

1. Detect and Control Agents

   • Identify when a session or connection is driven by an AI agent.

   • Enforce additional controls (like limited privileges or step-up authentication).

2. Identify and Manage Lifecycle of Managed Agents

   • Provision AI agents with their own identifiers and Deprovision when no longer needed.

   • Assign sponsors or custodians responsible for reviewing and recertifying agents access.

3. Govern Agents

   • Apply policy-based oversight, ensuring that agent privileges match organizational security and compliance requirements.

   • Review agent entitlements periodically, just as you would for human users.

4. Authenticate Users Out of Band

   • Prompt the human for high-risk tasks, using push notifications or another suitable MFA flow, when agents acting on their behalf.

   • Ensure credentials are not directly shared with the agent; instead, issue delegated tokens with limited scope.

5. Provide “Agent Indicators” to Applications

   • Tag or mark sessions as originating from an AI agent, so downstream services can respond appropriately—e.g., limiting access or showing specialized UI.

6. Authorize Agents

   • Restrict privileges to the narrowest needed set of actions (least privilege).

   • Use short-lived tokens or time-bound scopes to reduce risk if tokens are compromised.

7. Verify Human-in-the-Loop on Required Transactions

   • Prompt a human sponsor or end user whenever the agent attempts a sensitive operation, enabling real-time approvals.

   • Log these verification checkpoints for audit purposes.

8. Monitor / Audit / Track / Manage

   • Log agent activities separately for forensic analysis.

   • Detect anomalies—e.g., an agent accessing data outside normal patterns.

   • Revoke an agent’s credentials if it is compromised or exhibits malicious behavior.

By ensuring these capabilities, organizations can lay the groundwork for safely and efficiently integrating AI agents into their environments.