Managing 100,000 AI agents needs a scalable identity model

At a glance

What this is: This is an independent analysis of agentic identity scale, showing that AI agents are already widespread while governance, policy, and identity controls lag behind deployment.

Why it matters: It matters because IAM, IGA, PAM, and security architecture teams now have to govern autonomous or semi-autonomous identities at volumes that expose policy gaps, ownership gaps, and lifecycle failures across human, NHI, and agentic programmes.

By the numbers:

• 98% of respondents were in production, had a pilot program, or were planning one for AI agents.
• 79% of organisations lack written policies for governing AI agents.
• 62% of survey respondents believe their current identity and access management systems are not ready to scale to meet agentic needs.

👉 Read Ory's analysis of identity governance for 10,000 AI agents

Context

AI agent identity governance is the discipline of deciding how software entities with delegated or autonomous behaviour are authenticated, authorised, owned, reviewed, and revoked. The core problem here is scale: organisations are deploying agents faster than they can define policy, accountability, and access boundaries for them.

That mismatch breaks the assumptions behind conventional IAM. Human-centric review cycles, static service-account ownership, and policy documents written after deployment do not map cleanly to agentic systems that are created quickly, chained into workflows, and expected to keep operating without interruption.

The article’s main point is that enterprises are already beyond experimentation. The governance gap is now operational, not hypothetical, and the starting position in most organisations is typical rather than exceptional.

Key questions

Q: How should security teams limit the risk from AI agents that have access to production systems?

A: Security teams should scope every agent to the smallest set of actions and resources needed for its task, then remove standing privilege wherever possible. Use short-lived credentials, explicit approval for sensitive actions, and continuous review of what each identity can reach. The goal is to make compromise hard to turn into lateral movement or data exfiltration.

Q: Why do AI agents create new risk in non-human identity management?

A: AI agents create risk because they operate as software identities with delegated authority, but many organisations do not track them with the same discipline applied to users or service accounts. They can connect quickly, persist across teams, and accumulate permissions that are hard to review. That combination increases the chance of unnoticed access drift and credential exposure.

Q: What breaks when AI agents are connected through personal accounts or shared credentials?

A: Shared or personal credentials break accountability, lifecycle control, and revocation. If an agent inherits a human account, security teams lose clean ownership and cannot reliably attest what the identity can do or when it should be disabled. That creates an unmanaged backdoor into systems that may persist after the original setup is forgotten.

Q: What does Zero Trust mean for AI agent identity governance?

A: For AI agents, Zero Trust means every request is authenticated and authorised in context, with access granted only for the specific task and duration required. Long-lived trust, broad entitlements, and reusable tokens all undermine that model. Teams should use Zero Trust to reduce standing privilege and make agent access auditable and disposable.

Technical breakdown

Agentic identity at scale and the policy gap

Agentic identity is not just another workload identity pattern. These systems interact with APIs, trigger workflows, and may persist across many business processes, which means they need explicit identity ownership, authorisation scope, and revocation handling. The technical problem emerges when agents are created in sandboxes or pilots without a lifecycle model, then later pushed into production with shared credentials, hardcoded tokens, and unclear responsibility. At scale, the result is not simply sprawl but unauditable delegation chains. If no policy defines who owns the identity, what the agent may access, and when access ends, governance becomes retroactive and unreliable.

Practical implication: treat every agent as a governed identity from birth, not as a temporary automation artefact.

Zero Trust identity for AI agents and services

Zero Trust in agentic environments means each agent request is independently authenticated and authorised, with access granted only for the specific action and context in play. That matters because agentic systems often cross service boundaries, call multiple tools, and inherit privileges from upstream workflows. Open standards such as OAuth 2.0 and OpenID Connect help, but the real control point is fine-grained authorisation and continuous revocation. The architecture must assume that trust is transient and that access should be narrow, observable, and disposable. Without that, agent identity becomes a proxy for standing privilege rather than a controlled runtime subject.

Practical implication: enforce narrow, tool-specific authorisation boundaries instead of broad agent-wide entitlements.

Token rotation, revocation, and auditability in agent workflows

Agentic systems depend on credentials that can be issued, rotated, revoked, and traced without breaking downstream services. The hard part is that many organisations still rely on tokens embedded in scripts, shared secrets across systems, and workflows that do not expose clean ownership metadata. Technically, that creates an access layer that is difficult to audit and harder to recover after compromise. Rotation alone is not sufficient if the environment cannot prove which agent used which credential, for what purpose, and under which policy state. Governance at this layer requires traceability, not just freshness.

Practical implication: make every agent credential traceable to an owner, a policy, and a revocation path before production use.

NHI Mgmt Group analysis

AI agent governance has become a scale problem before it becomes a maturity problem. The article’s central evidence is that deployment is already near-universal while written policy is still absent for most organisations. That means the market is not waiting for more experimentation, it is waiting for governance that can keep pace with operational reality. For identity leaders, the important shift is that agentic AI is now a lifecycle and entitlement management issue, not a future-state architecture discussion.

Documented policy is the new minimum control for agentic identity, not a paperwork exercise. When 79% of organisations lack written policies, identity controls are being asked to operate without explicit decision rights, ownership, or revocation criteria. That is a governance failure, not merely a documentation gap. The practical conclusion is that policy must define who approves, who owns, and who can terminate agent access before agent deployment expands further.

Zero Trust for agents only works when authorisation is runtime-specific and disposable. Agents that interact with APIs and internal workflows cannot be managed as if their access profile were stable or human-paced. Fine-grained OAuth and OIDC flows help, but the underlying discipline is dynamic authorisation with short-lived privilege and auditable boundaries. Practitioners should read this as a reminder that broad reusable entitlements are structurally misaligned with agentic behaviour.

Identity ownership is the missing control plane in most agent deployments. The article repeatedly points to shared credentials, hardcoded tokens, and workflows no one fully owns. That pattern creates accountability gaps across IAM, IGA, and PAM because no one can confidently answer who can revoke the agent, who certifies its access, or who is responsible when it misbehaves. The implication is that agent identity must be managed as a first-class subject with explicit lifecycle ownership.

Scalable AI identity will converge human, NHI, and agent governance into one model. The strongest signal in the article is not the agent count alone, but the need to govern people, machines, and autonomous systems through the same architectural discipline. That does not mean the controls are identical. It means lifecycle, access, and audit principles must be consistent across actor types if enterprises want to avoid fragmented identity sprawl. The practitioners who unify these models early will have the clearest path to enforceable governance.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• For the governance implications behind that exposure, see OWASP Agentic AI Top 10 for the most relevant agentic application risk patterns.

What this signals

Agentic identity is now a governance programme design issue, not an experimental control problem. With 80% of organisations already reporting agent actions beyond intended scope, the operational question is whether IAM, IGA, and PAM can be extended to runtime decision-making without collapsing into manual exception handling. Teams that keep treating agents like static service accounts will accumulate unreviewable privilege and weak ownership.

Runtime authorisation will become the differentiator between scalable control and policy theatre. The organisations that succeed will not be the ones with the longest policy documents, but the ones that can prove who authorised each action, for which agent, and under what boundary. That points directly to NIST AI Risk Management Framework style governance and to identity models that support continuous verification.

Agent lifecycle management is converging with NHI governance faster than most programmes expect. Once agents are issued credentials, access tokens, and API permissions, they inherit the same lifecycle pressure as service accounts. The difference is that the access may be more dynamic, more distributed, and more difficult to certify at scale, which is why teams should align their agent governance with the same discipline used for workload identity and secrets control.

For practitioners

• Define agent ownership before deployment Assign a named business and technical owner to every AI agent, with explicit authority for approval, review, and shutdown. Do not allow shadow agents or shared operational ownership to persist into production.
• Replace shared secrets with scoped, revocable credentials Issue agent credentials that are individually traceable, narrowly scoped, and easy to revoke without affecting unrelated workloads. Eliminate hardcoded tokens in scripts and workflows wherever they can be replaced.
• Build agent policy into the deployment path Require documented access policy, authorisation scope, and revocation criteria before an agent can move from pilot to production. Treat policy absence as a deployment blocker rather than an after-the-fact remediation task.
• Instrument audit trails for every agent action Log which agent acted, which identity was used, which resources were touched, and which policy decision authorised the action. Use those records for access review, incident response, and compliance evidence.

Key takeaways

• AI agent deployment is already mainstream, but governance remains far behind the pace of adoption.
• Identity teams need runtime authorisation, ownership, and revocation controls that can survive agentic scale.
• Agent governance will fail if organisations keep relying on static policies, shared secrets, and unclear accountability.

Key terms

• Agentic Identity: An agentic identity is a non-human identity used by an autonomous system that can act, call tools, and access data with execution authority. It needs the same governance discipline as other privileged identities, plus runtime context, ownership mapping, and revocation paths.
• Runtime Authorisation: Runtime authorisation is the practice of deciding access while a task is in progress, rather than only at provisioning time. It matters for NHIs because credentials and entitlements can change risk mid-session, especially when automation or AI agents interact with sensitive systems.
• AI Agent Lifecycle Governance: The set of controls that assigns, constrains, monitors, and retires autonomous agents across their full operating life. It extends IAM practice to software that can act on its own, making ownership, scope, auditability, and revocation mandatory rather than optional.

What's in the full article

Ory's full article covers the operational detail this post intentionally leaves for the source:

• The survey framing and adoption breakdown behind the 98% agentic deployment figure
• The platform-level identity model Ory proposes for agents, users, and services under Zero Trust
• Implementation detail on token rotation, revocation, and auditing in agent workflows
• The CockroachDB integration discussion for globally distributed identity data and behavioural tracking

👉 Ory's full post covers the survey context, identity architecture, and scale considerations in more operational detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.