Notifications
Clear all
Topic starter
20/08/2026 5:39 pm
TL;DR: AI agents are being framed as autonomous software that can plan and act on their own, and Ory argues that secure digital identity is the missing foundation for accountability, least privilege, and auditability across enterprise workflows. The governing assumption collapses when agents can initiate actions without a stable identity tether, because existing IAM review and logging models were built for human-paced access, not autonomous execution.
NHIMG editorial — based on content published by Ory: Digital Identity is the Next Frontier for AI Agents
Questions worth separating out
Q: How should security teams govern AI agents that can access enterprise systems?
A: Security teams should govern AI agents as non-human identities with explicit ownership, scoped privileges, and continuous monitoring.
Q: Why do AI agents complicate least privilege controls?
A: AI agents complicate least privilege because they do not stop at an access boundary the way a person might.
Q: How do organisations know whether AI identity monitoring is actually working?
A: Monitoring is working when teams can see which agent initiated each action, which tool was used, what data was touched, and whether the sequence matches the approved purpose.
Practitioner guidance
- Establish a dedicated agent identity model Define each AI agent as a unique principal with a sponsor, purpose, version, and permitted tool scope.
- Bind permissions to task-specific scope Limit every agent to the smallest workable set of systems, APIs, and data sources for the job at hand.
- Log provenance as part of the identity record Capture creator, approver, model version, policy context, and execution details so each action can be traced back to a governed source.
What's in the full article
Ory's full article covers the operational detail this post intentionally leaves for the source:
- The article expands on why secure digital identity is the accountability layer for autonomous agents across enterprise systems.
- It explains how IAM concepts such as least privilege, traceability, and policy enforcement apply to software actors.
- It frames the governance burden around creators, sponsors, scope, versioning, and data model lineage for each agent.
- It links the identity argument to compliance and auditability concerns that matter to security and legal teams.
👉 Read Ory's analysis of digital identity for autonomous AI agents →
AI agent identity: are your governance controls ready yet?
Explore further
20/08/2026 6:24 pm
AI agent identity is becoming the control plane for accountability. Once an agent can act without a human approving each step, the identity record is no longer just an authentication artefact. It becomes the only durable way to tie actions back to a sponsor, purpose, and policy boundary. That shifts the identity programme from user-centric access management to principal-centric governance across software actors. Practitioners should treat identity as the foundation for evidencing responsibility, not a wrapper around automation.
A few things that frame the scale:
- 98% of companies plan to deploy even more AI agents within the next 12 months, despite documented rogue behaviour in 80% of current deployments, according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
A question worth separating out:
Q: Who is accountable when an AI agent makes a risky decision?
A: Accountability should rest with the organisation that authorised the agent, the human owner of the workflow, and the control process that allowed the behaviour. If an agent can act independently, the programme must preserve attribution, action logs, and policy decisions so audit and remediation are possible after the event.
👉 Read our full editorial: Digital identity for AI agents is becoming the governance baseline
