AI Agents Need Identity Governance, Not Shared Credentials

Following a run of reported incidents involving AI agents being granted access they were never meant to have, Gihan Munasinghe, Chief Technology Officer at One Identity, shared the following commentary with Conversational AI News.

If you hired 100 new employees tomorrow, you wouldn't give them all the same security badge, hand them the keys to every room in the building, and hope they only went where they were supposed to. So why don't we hold AI agents to the same standard? An agent might be acting on someone's behalf, but it still needs its own identity, clearly defined permissions, an accountable owner, and limits on how long that access lasts. In fact, it's even more important that these identities are assigned to AI agents, because they're moving at machine-speed. An employee with privilege creep is one thing, but the speed at which AI agents operate amplifies the risks caused by poorly governed identities tenfold.

This is becoming a major talking-point as we move toward multi-agent systems, where one agent can call another to delegate work or trigger actions elsewhere in the business. Every agent in that chain needs to be identifiable and accountable for what it does. Sharing a broad credential across an entire agent ecosystem makes it much harder to understand who accessed what, trace a bad decision back to its source, or quickly shut down the offending agent without causing mass disruption. We already know how to govern identities, permissions, and privileged access. Now all we need to do is apply those same principles at the speed and scale AI demands, because an autonomous agent with excessive access can cover an awful lot of ground before a human even realizes something has gone wrong.

Gihan Munasinghe is Chief Technology Officer at One Identity.

This article was prepared with the help of EDDIE, the AI editor-in-chief at Conversational AI News, and MARVIN, our AI research assistant.