Every enterprise AI agent should have a unique non-human identity, and every action should carry the relevant user or organisational delegation separately. Authorisation must evaluate the agent, delegating principal, target resource, requested action and current context. Shared service accounts or user-token passthrough erase accountability and create excessive privilege.
The decision matters now because technology, standards, operating risk and buyer expectations are changing faster than many enterprise delivery models. A useful response must connect architecture with ownership, economics, security, implementation and measurable outcomes. This guide is designed for leaders who need a defensible production plan rather than a trend summary.
Why agents change the identity problem
Agents plan and act across multiple tools, so one request can create a long chain of delegated operations and changing context. In practice, this makes why agents change the identity problem an owned business and engineering decision rather than a general recommendation. The team should identify the accountable owner, required evidence, dependencies, failure states and acceptance signal before implementation begins. Applied to ai agent identity and authorisation, this prevents attractive activity from masking unresolved operational risk and gives leadership a basis for deciding whether to proceed, change sequence or stop.
A human login does not prove that every later tool invocation remains within the user's intent or authority. The architecture consequence is that why agents change the identity problem cannot be delegated entirely to a tool, framework or supplier default. Product, engineering, security, data and operations should agree the boundary, exercise it with representative scenarios and record important exceptions. The resulting capability should be observable in business terms, reversible where possible and maintainable by the people who will own ai agent identity and authorisation after launch.
Models can be manipulated by external content, making identity controls essential even when the agent application is trusted. A serious programme converts this principle into a backlog item with evidence, an owner, a dependency map, an acceptance test and a release decision. It also tests the negative path: stale information, unavailable dependencies, conflicting state, excessive privilege, malformed inputs and partial completion. That proof is more valuable than claiming that why agents change the identity problem follows best practice because it shows whether the operating model survives pressure.
Treat agents as privileged software actors whose authority must be explicit, bounded, observable and revocable. Leaders should ask what changes for the customer or operator, which system remains authoritative and how failure will be detected, contained and recovered. The answer should cover identity, data, workflow, telemetry, cost and support. When those elements are missing, why agents change the identity problem becomes another layer of hidden complexity rather than a dependable part of ai agent identity and authorisation.
Separate agent, user and service identities
Assign each agent runtime or deployed capability a unique workload identity instead of a shared organisational credential. In practice, this makes separate agent, user and service identities an owned business and engineering decision rather than a general recommendation. The team should identify the accountable owner, required evidence, dependencies, failure states and acceptance signal before implementation begins. Applied to ai agent identity and authorisation, this prevents attractive activity from masking unresolved operational risk and gives leadership a basis for deciding whether to proceed, change sequence or stop.
Preserve end-user, tenant, organisation and agent identities as distinct attributes through every service hop. The architecture consequence is that separate agent, user and service identities cannot be delegated entirely to a tool, framework or supplier default. Product, engineering, security, data and operations should agree the boundary, exercise it with representative scenarios and record important exceptions. The resulting capability should be observable in business terms, reversible where possible and maintainable by the people who will own ai agent identity and authorisation after launch.
Separate orchestrator identity from individual tool, worker and remote-agent identities according to trust boundaries. A serious programme converts this principle into a backlog item with evidence, an owner, a dependency map, an acceptance test and a release decision. It also tests the negative path: stale information, unavailable dependencies, conflicting state, excessive privilege, malformed inputs and partial completion. That proof is more valuable than claiming that separate agent, user and service identities follows best practice because it shows whether the operating model survives pressure.
Maintain an inventory linking non-human identities to owners, environments, capabilities, credentials and review dates. Leaders should ask what changes for the customer or operator, which system remains authoritative and how failure will be detected, contained and recovered. The answer should cover identity, data, workflow, telemetry, cost and support. When those elements are missing, separate agent, user and service identities becomes another layer of hidden complexity rather than a dependable part of ai agent identity and authorisation.
Design delegated authority
Represent what the user authorised, for which resource, purpose, duration, limits and approval conditions. In practice, this makes design delegated authority an owned business and engineering decision rather than a general recommendation. The team should identify the accountable owner, required evidence, dependencies, failure states and acceptance signal before implementation begins. Applied to ai agent identity and authorisation, this prevents attractive activity from masking unresolved operational risk and gives leadership a basis for deciding whether to proceed, change sequence or stop.
Use short-lived scoped delegation instead of copying a broad user token across tools and agents. The architecture consequence is that design delegated authority cannot be delegated entirely to a tool, framework or supplier default. Product, engineering, security, data and operations should agree the boundary, exercise it with representative scenarios and record important exceptions. The resulting capability should be observable in business terms, reversible where possible and maintainable by the people who will own ai agent identity and authorisation after launch.
Require step-up approval when an agent moves from reading or recommending to irreversible, financial or externally visible action. A serious programme converts this principle into a backlog item with evidence, an owner, a dependency map, an acceptance test and a release decision. It also tests the negative path: stale information, unavailable dependencies, conflicting state, excessive privilege, malformed inputs and partial completion. That proof is more valuable than claiming that design delegated authority follows best practice because it shows whether the operating model survives pressure.
Expire delegation when the task ends, context changes, risk increases or the user withdraws authority. Leaders should ask what changes for the customer or operator, which system remains authoritative and how failure will be detected, contained and recovered. The answer should cover identity, data, workflow, telemetry, cost and support. When those elements are missing, design delegated authority becomes another layer of hidden complexity rather than a dependable part of ai agent identity and authorisation.
Apply policy at every resource boundary
Enforce object and action permission in the authoritative API or data service rather than trusting agent instructions. In practice, this makes apply policy at every resource boundary an owned business and engineering decision rather than a general recommendation. The team should identify the accountable owner, required evidence, dependencies, failure states and acceptance signal before implementation begins. Applied to ai agent identity and authorisation, this prevents attractive activity from masking unresolved operational risk and gives leadership a basis for deciding whether to proceed, change sequence or stop.
Evaluate tenant, role, record ownership, data sensitivity, transaction value, location, device and workflow state where relevant. The architecture consequence is that apply policy at every resource boundary cannot be delegated entirely to a tool, framework or supplier default. Product, engineering, security, data and operations should agree the boundary, exercise it with representative scenarios and record important exceptions. The resulting capability should be observable in business terms, reversible where possible and maintainable by the people who will own ai agent identity and authorisation after launch.
Keep retrieval permissions aligned with source systems so unauthorised content never enters model context. A serious programme converts this principle into a backlog item with evidence, an owner, a dependency map, an acceptance test and a release decision. It also tests the negative path: stale information, unavailable dependencies, conflicting state, excessive privilege, malformed inputs and partial completion. That proof is more valuable than claiming that apply policy at every resource boundary follows best practice because it shows whether the operating model survives pressure.
Return structured denials that help the workflow escalate safely without revealing protected information. Leaders should ask what changes for the customer or operator, which system remains authoritative and how failure will be detected, contained and recovered. The answer should cover identity, data, workflow, telemetry, cost and support. When those elements are missing, apply policy at every resource boundary becomes another layer of hidden complexity rather than a dependable part of ai agent identity and authorisation.
Credentials, tokens and secret handling
Use workload identity federation, audience-bound tokens, least-privilege scopes and secure credential storage. In practice, this makes credentials, tokens and secret handling an owned business and engineering decision rather than a general recommendation. The team should identify the accountable owner, required evidence, dependencies, failure states and acceptance signal before implementation begins. Applied to ai agent identity and authorisation, this prevents attractive activity from masking unresolved operational risk and gives leadership a basis for deciding whether to proceed, change sequence or stop.
Never forward a token intended for one resource into another service or record secrets inside prompts and traces. The architecture consequence is that credentials, tokens and secret handling cannot be delegated entirely to a tool, framework or supplier default. Product, engineering, security, data and operations should agree the boundary, exercise it with representative scenarios and record important exceptions. The resulting capability should be observable in business terms, reversible where possible and maintainable by the people who will own ai agent identity and authorisation after launch.
Rotate credentials, restrict network destinations and monitor use outside expected tools, tenants or environments. A serious programme converts this principle into a backlog item with evidence, an owner, a dependency map, an acceptance test and a release decision. It also tests the negative path: stale information, unavailable dependencies, conflicting state, excessive privilege, malformed inputs and partial completion. That proof is more valuable than claiming that credentials, tokens and secret handling follows best practice because it shows whether the operating model survives pressure.
Design emergency revocation that disables one agent capability without taking down unrelated identity infrastructure. Leaders should ask what changes for the customer or operator, which system remains authoritative and how failure will be detected, contained and recovered. The answer should cover identity, data, workflow, telemetry, cost and support. When those elements are missing, credentials, tokens and secret handling becomes another layer of hidden complexity rather than a dependable part of ai agent identity and authorisation.
Auditability, revocation and non-repudiation
Record the principal, agent, delegation, policy, resource, action, evidence, approval and final state for consequential work. In practice, this makes auditability, revocation and non-repudiation an owned business and engineering decision rather than a general recommendation. The team should identify the accountable owner, required evidence, dependencies, failure states and acceptance signal before implementation begins. Applied to ai agent identity and authorisation, this prevents attractive activity from masking unresolved operational risk and gives leadership a basis for deciding whether to proceed, change sequence or stop.
Use correlation identifiers across model calls, APIs, tools and business events so an outcome can be reconstructed. The architecture consequence is that auditability, revocation and non-repudiation cannot be delegated entirely to a tool, framework or supplier default. Product, engineering, security, data and operations should agree the boundary, exercise it with representative scenarios and record important exceptions. The resulting capability should be observable in business terms, reversible where possible and maintainable by the people who will own ai agent identity and authorisation after launch.
Protect audit records from alteration while minimising sensitive prompt and customer data retained in telemetry. A serious programme converts this principle into a backlog item with evidence, an owner, a dependency map, an acceptance test and a release decision. It also tests the negative path: stale information, unavailable dependencies, conflicting state, excessive privilege, malformed inputs and partial completion. That proof is more valuable than claiming that auditability, revocation and non-repudiation follows best practice because it shows whether the operating model survives pressure.
Establish non-repudiation and approval evidence appropriate to financial, regulated and high-impact workflows. Leaders should ask what changes for the customer or operator, which system remains authoritative and how failure will be detected, contained and recovered. The answer should cover identity, data, workflow, telemetry, cost and support. When those elements are missing, auditability, revocation and non-repudiation becomes another layer of hidden complexity rather than a dependable part of ai agent identity and authorisation.
Reference architecture and failure handling
Place an agent identity broker or control plane around credential exchange, delegation, policy, discovery and telemetry. In practice, this makes reference architecture and failure handling an owned business and engineering decision rather than a general recommendation. The team should identify the accountable owner, required evidence, dependencies, failure states and acceptance signal before implementation begins. Applied to ai agent identity and authorisation, this prevents attractive activity from masking unresolved operational risk and gives leadership a basis for deciding whether to proceed, change sequence or stop.
Persist workflow state outside the model and re-evaluate authority before delayed or retried actions. The architecture consequence is that reference architecture and failure handling cannot be delegated entirely to a tool, framework or supplier default. Product, engineering, security, data and operations should agree the boundary, exercise it with representative scenarios and record important exceptions. The resulting capability should be observable in business terms, reversible where possible and maintainable by the people who will own ai agent identity and authorisation after launch.
Handle expired tokens, denied access, changed user roles, revoked agents and unavailable policy services explicitly. A serious programme converts this principle into a backlog item with evidence, an owner, a dependency map, an acceptance test and a release decision. It also tests the negative path: stale information, unavailable dependencies, conflicting state, excessive privilege, malformed inputs and partial completion. That proof is more valuable than claiming that reference architecture and failure handling follows best practice because it shows whether the operating model survives pressure.
Default to safe failure and human escalation instead of broadening scope or reusing stale credentials. Leaders should ask what changes for the customer or operator, which system remains authoritative and how failure will be detected, contained and recovered. The answer should cover identity, data, workflow, telemetry, cost and support. When those elements are missing, reference architecture and failure handling becomes another layer of hidden complexity rather than a dependable part of ai agent identity and authorisation.
Implementation roadmap and partner selection
Inventory current agents, service accounts, tools and data paths before defining the target identity pattern. In practice, this makes implementation roadmap and partner selection an owned business and engineering decision rather than a general recommendation. The team should identify the accountable owner, required evidence, dependencies, failure states and acceptance signal before implementation begins. Applied to ai agent identity and authorisation, this prevents attractive activity from masking unresolved operational risk and gives leadership a basis for deciding whether to proceed, change sequence or stop.
Implement one high-value workflow with unique identity, scoped delegation, policy evidence, revocation and incident tests. The architecture consequence is that implementation roadmap and partner selection cannot be delegated entirely to a tool, framework or supplier default. Product, engineering, security, data and operations should agree the boundary, exercise it with representative scenarios and record important exceptions. The resulting capability should be observable in business terms, reversible where possible and maintainable by the people who will own ai agent identity and authorisation after launch.
Standardise reusable identity libraries, tool gateways, policy templates and ownership without hiding domain authorisation. A serious programme converts this principle into a backlog item with evidence, an owner, a dependency map, an acceptance test and a release decision. It also tests the negative path: stale information, unavailable dependencies, conflicting state, excessive privilege, malformed inputs and partial completion. That proof is more valuable than claiming that implementation roadmap and partner selection follows best practice because it shows whether the operating model survives pressure.
Select partners that understand IAM, APIs, AI orchestration, security testing, observability and regulated evidence. Leaders should ask what changes for the customer or operator, which system remains authoritative and how failure will be detected, contained and recovered. The answer should cover identity, data, workflow, telemetry, cost and support. When those elements are missing, implementation roadmap and partner selection becomes another layer of hidden complexity rather than a dependable part of ai agent identity and authorisation.
