[Identity Fundamentals](https://www.pingidentity.com/en/resources/identity-fundamentals.html) [Identity and Access Management](https://www.pingidentity.com/en/resources/identity-fundamentals/identity-and-access-management.html) [Agentic AI](https://www.pingidentity.com/en/resources/identity-fundamentals/agentic-ai.html) [Key IAM Considerations to Support Agentic AI](https://www.pingidentity.com/en/resources/identity-fundamentals/agentic-ai/key-iam-considerations.html) [AI Agent Classes and Use Cases](https://www.pingidentity.com/en/resources/identity-fundamentals/agentic-ai/classes-and-use-cases.html) [IAM Best Practices for AI Agents](https://www.pingidentity.com/en/resources/identity-fundamentals/agentic-ai/iam-best-practices-ai-agents.html) [Reference Implementations and Patterns](https://www.pingidentity.com/en/resources/identity-fundamentals/agentic-ai/reference-implementation-patterns.html) [Runtime Identity](https://www.pingidentity.com/en/resources/identity-fundamentals/agentic-ai/runtime-identity.html) [Headless Identity](https://www.pingidentity.com/en/resources/identity-fundamentals/agentic-ai/headless-identity.html) [B2B Identity and Access Management](https://www.pingidentity.com/en/resources/identity-fundamentals/b2b-identity.html) [Identity Providers and Service Providers](https://www.pingidentity.com/en/resources/identity-fundamentals/identity-providers-service-providers.html) [Centralized Identity Management](https://www.pingidentity.com/en/resources/identity-fundamentals/centralized-identity-management.html) [What is Centralized Identity Management?](https://www.pingidentity.com/en/resources/identity-fundamentals/centralized-identity-management/what-is-centralized-identity-management.html) [How Does Centralized Identity Management Work?](https://www.pingidentity.com/en/resources/identity-fundamentals/centralized-identity-management/how-does-centralized-identity-management-work.html) [Centralized Identity Standards](https://www.pingidentity.com/en/resources/identity-fundamentals/centralized-identity-management/authentication-authorization-standards.html) [SAML](https://www.pingidentity.com/en/resources/identity-fundamentals/centralized-identity-management/authentication-authorization-standards/saml.html) [OAuth](https://www.pingidentity.com/en/resources/identity-fundamentals/centralized-identity-management/authentication-authorization-standards/oauth.html) [OpenID Connect (OIDC)](https://www.pingidentity.com/en/resources/identity-fundamentals/centralized-identity-management/authentication-authorization-standards/openid-connect.html) [Decentralized Identity Management](https://www.pingidentity.com/en/resources/identity-fundamentals/decentralized-identity-management.html) [What is Decentralized Identity Management?](https://www.pingidentity.com/en/resources/identity-fundamentals/decentralized-identity-management/what-is-decentralized-identity-management.html) [How Does Decentralized Identity Management Work?](https://www.pingidentity.com/en/resources/identity-fundamentals/decentralized-identity-management/how-does-decentralized-identity-management-work-.html) [How is Decentralized Identity Different?](https://www.pingidentity.com/en/resources/identity-fundamentals/decentralized-identity-management/how-is-decentralized-identity-different.html) [Decentralized Identity Standards](https://www.pingidentity.com/en/resources/identity-fundamentals/decentralized-identity-management/decentralized-identity-standards.html) [Common Terms](https://www.pingidentity.com/en/resources/identity-fundamentals/decentralized-identity-management/common-terms.html) [Zero Trust Security](https://www.pingidentity.com/en/resources/identity-fundamentals/zero-trust-security.html) [Orchestration](https://www.pingidentity.com/en/resources/identity-fundamentals/identity-orchestration.html) [Authentication](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication.html) [Single-factor, Two-factor, and Multi-factor Authentication](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication/single-factor-two-factor-multi-factor-authentication.html) [Passwordless Authentication](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication/passwordless-authentication.html) [FIDO Authentication: WebAuthn, FIDO2 & CTAP2 Explained](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication/passwordless-authentication/fido.html) [Risk-based Authentication](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication/risk-based-authentication.html) [Certificate-based Authentication](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication/certificate-authentication.html) [Token-based Authentication](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication/token-based-authentication.html) [Single Sign-On (SSO)](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication/single-sign-on.html) [What Is Federated Identity?](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication/federated-identity-management.html) [Continuous Authentication](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication/continuous-authentication.html) [CHAP Authentication](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication/chap-authentication.html) [Authorization](https://www.pingidentity.com/en/resources/identity-fundamentals/authorization.html) [What Is Adaptive Access Control? RBAC vs. Adaptive](https://www.pingidentity.com/en/resources/identity-fundamentals/authorization/authorization-methods.html) [User and Account Provisioning](https://www.pingidentity.com/en/resources/identity-fundamentals/authorization/user-account-provisioning.html) [Single Sign-on with a Directory](https://www.pingidentity.com/en/resources/identity-fundamentals/authorization/sso-directory.html) [Dynamic Authorization](https://www.pingidentity.com/en/resources/identity-fundamentals/authorization/dynamic-authorization.html) [Protocols](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication-authorization-protocols.html) [LDAP](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication-authorization-protocols/ldap.html) [SCIM](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication-authorization-protocols/scim.html) [WebAuthn](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication-authorization-protocols/webauthn.html) [Kerberos](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication-authorization-protocols/kerberos.html) [WS-Trust](https://www.pingidentity.com/en/resources/identity-fundamentals/authentication-authorization-protocols/ws-trust.html) [Verification](https://www.pingidentity.com/en/resources/identity-fundamentals/verification.html) [Shared Device Authentication](https://www.pingidentity.com/en/resources/identity-fundamentals/shared-device-authentication.html) Expand All | Collapse All # Key IAM Considerations to Support Agentic AI ## Key Challenges AI agents pose unique IAM challenges: - **Scale & Autonomy**: Organizations could see thousands of agents operating independently, requiring controls for on/offboarding and delegated authority. - **Mixed Identities**: Agents may act on behalf of a user or as autonomous entities with their own credentials. - **Threat & Detection**: Traditional “bot detection” may erroneously block legitimate AI agents, or fail to catch malicious ones. - **Governance & Oversight**: Sponsors or custodians must monitor an agent’s behavior, entitlements, and risk posture. - **Consent & Delegation**: Over-permissive delegation may expose excessive data; organizations should allow more fine-grained entitlements and require human oversight for sensitive tasks. Insufficiently specific consent or a lack of explicit boundaries on an agent’s permission may result in agents taking actions users did not believe they had authorized, leading to unhappy customers and attempts to roll back transactions initiated by authorized agents (e.g. purchase chargebacks). ## What an IAM System Should Support Looking ahead, organizations should evaluate whether their IAM systems can do the following: 1. **Provide Visibility** - Computer Using Agents (CUA) detection - Enterprise agent discovery - Agent platform integrations - Agent service accounts 1. **Onboard & Manage Agents** - Unique agent identity type - Agent ownership - MCP tools and resources - Provisioning and registration - Policy management - Delegated entitlements 1. **Authenticate & Authorize Agents** - OAuth authorization - MCP gateway - Policy enforcement - Agent-specific protocols 1. **Ensure Human Oversight** - Explicit consent - Human-in-the-loop authorization - Audit trails - Request & approvals support - Governance & certification - JIT privileges - Policy constraints - Agent/human experiences 1. **Protect Against Threats** - Threat detection for AI-based threats - Automated threat response - Admin reviews By ensuring these capabilities, organizations can lay the groundwork for safely and efficiently integrating AI agents into their environments. Start Today Contact Sales [sales@pingidentity.com](mailto:sales@pingidentity.com) See how Ping can help you deliver secure employee, partner, and customer experiences in a rapidly evolving digital world.