Key IAM Considerations to Support Agentic AI

Key Challenges

AI agents pose unique IAM challenges:

• Scale & Autonomy: Organizations could see thousands of agents operating independently, requiring controls for on/offboarding and delegated authority.

• Mixed Identities: Agents may act on behalf of a user or as autonomous entities with their own credentials.

• Threat & Detection: Traditional “bot detection” may erroneously block legitimate AI agents, or fail to catch malicious ones.

• Governance & Oversight: Sponsors or custodians must monitor an agent’s behavior, entitlements, and risk posture.

• Consent & Delegation: Over-permissive delegation may expose excessive data; organizations should allow more fine-grained entitlements and require human oversight for sensitive tasks. Insufficiently specific consent or a lack of explicit boundaries on an agent’s permission may result in agents taking actions users did not believe they had authorized, leading to unhappy customers and attempts to roll back transactions initiated by authorized agents (e.g. purchase chargebacks).

What an IAM System Should Support

Looking ahead, organizations should evaluate whether their IAM systems can do the following:

1. Provide Visibility

   • Computer Using Agents (CUA) detection

   • Enterprise agent discovery

   • Agent platform integrations

   • Agent service accounts

2. Onboard & Manage Agents

   • Unique agent identity type

   • Agent ownership

   • MCP tools and resources

   • Provisioning and registration

   • Policy management

   • Delegated entitlements

3. Authenticate & Authorize Agents

   • OAuth authorization

   • MCP gateway

   • Policy enforcement

   • Agent-specific protocols

4. Ensure Human Oversight

   • Explicit consent

   • Human-in-the-loop authorization

   • Audit trails

   • Request & approvals support

   • Governance & certification

   • JIT privileges

   • Policy constraints

   • Agent/human experiences

5. Protect Against Threats

   • Threat detection for AI-based threats

   • Automated threat response

   • Admin reviews

By ensuring these capabilities, organizations can lay the groundwork for safely and efficiently integrating AI agents into their environments.