Enterprises have put AI agents into production well ahead of the identity programs meant to govern them. Gravitee’s State of AI Agent Security 2026 report, which surveyed more than 900 executives and practitioners, found that 81% of technical teams are now testing or running agents in production, but only 14% said every one of those agents went live with full security and IT approval. Over the past year, 88% of organizations confirmed or suspected an agent-related security incident.
Most of those problems trace back to identity. Agents log in to systems, call APIs, read and write data and, more and more often, spin up and direct other agents. Yet in most organizations they sit outside the access reviews and lifecycle controls applied to employees and, frequently, to ordinary service accounts as well.
Identities: A New Kind of Principal
Identity and access management grew up around two kinds of accounts. People log in, change roles, and eventually leave the company, while applications run under service accounts that perform the same narrow set of tasks day after day. Agents don’t sit neatly in either category. They act on their own initiative the way a user does, but at machine speed, and their behavior can shift with every model update, prompt, or new tool they are given.
Forrester made a similar point in its recap of Identiverse 2026, noting that agents don’t fit the static, human-paced model most identity governance tooling was designed around and that organizations will need new ways to discover agents and set access policy for them. The firm also stressed that each agent identity should link to the person who created it and is accountable for it—a connection existing tools seldom record.
Standards work is moving in the same direction. NIST launched its AI Agent Standards Initiative in February with identity and authorization as a primary focus, and its National Cybersecurity Center of Excellence followed with a concept paper on adapting OAuth, OpenID Connect and SPIFFE for agents. Among the issues it identified as least settled is multi-hop delegation, in which one agent acts on behalf of another.
What the Identity Gap Looks Like in Practice
The clearest warning sign is how agents authenticate. Gravitee found that just 22% of teams treat agents as distinct identities, and 46% still use shared API keys when agents communicate with one another. With a shared key, logs can’t reliably show which agent did what, and cutting off one misbehaving agent means cutting off every agent that uses the same credential.
Visibility is limited as well. In the 2026 CISO AI Risk Report from Cybersecurity Insiders and Saviynt, 75% of security leaders said they had found unsanctioned AI tools running in production. Seventy-one percent said AI tools already have access to core systems such as Salesforce and SAP, though only 16% believe they govern that access effectively. An IDC white paper sponsored by GuidePoint Security puts the share of organizations running continuous identity discovery at fewer than 1 in 5, with only 27% having fully automated identity governance for agents.
Few organizations appear prepared for an agent-related incident. Only 5% of respondents to the CISO survey said they were confident they could contain a compromised agent, and Gravitee found that on average fewer than half (47%) of an organization’s agents are actively monitored or secured. The problem compounds as agents begin delegating to one another. According to Gravitee, a quarter of deployed agents (25%) can create and assign work to other agents, and every added link in that chain makes it more difficult to establish who authorized an action in the first place.
Building Governance for Agents
Formal standards are still being written, but organizations don’t need to wait for them to put the fundamentals in place, most of which come directly from existing zero trust and identity practice. The starting point is an inventory: a registry, kept current through continuous discovery, that records what each agent does, which systems it can reach, and which person owns it. From there, each agent needs its own credentials, ideally short-lived and scoped to a specific task, in place of the shared API keys many teams rely on today.
Permissions should be limited to the work at hand, and when one agent delegates to another, the handoff should be recorded so the chain of authority can be reconstructed later. Agents also need the lifecycle discipline applied to employee accounts, from provisioning through periodic review to decommissioning, along with the ability to revoke a compromised agent’s access immediately. Every action should leave a record tying it to the agent that took it, the person accountable for that agent, and the policy that allowed it. For teams mapping these controls to specific threats, the OWASP Top 10 for Agentic Applications covers risks ranging from goal hijacking to rogue agents.
Most of these controls already exist for human and service accounts, so the work lies in extending them to agents before deployment rather than after an incident. Organizations that take that step now will be in a far stronger position to expand their use of autonomous agents safely.
