Topic starter
18/08/2026 2:41 pm
TL;DR: Seven AI agent types span simple reflex to multi-agent systems, and Ory argues the right architecture depends on observability, goal complexity, learning needs, and coordination. The identity conclusion is sharper than the taxonomy itself: every agent type needs identity, and once agents take real actions on real systems, authorization and delegation become the governing problem.
Editorial analysis by NHI Mgmt Group, based on content published by Ory: “Types of AI Agents: How to Understand and Choose the Right One”.
Key questions
Q: What breaks when organisations treat agentic AI like ordinary automation?
A: They often miss that autonomous systems can decide timing, sequence, and tool choice at runtime.
Q: Why do AI agents require stronger identity controls than standard applications?
A: AI agents can choose actions, call tools, and chain operations, so their identity is not just a login mechanism.
Q: How should security teams govern multi-hop agent delegation chains?
A: Security teams should govern multi-hop delegation as a chain of explicit authorisations, not as a series of disconnected API calls.
Practitioner guidance
- Define the agent identity boundary Separate the model, the wrapper, and the tool layer in your architecture diagram, then assign identity and authorisation controls to the layer that actually executes actions.
- Classify agent types before production Tag each use case as reflex, goal-based, learning, hierarchical, or multi-agent so you can size the delegation and audit model to the actual runtime behaviour.
- Design delegated access for sub-agents Require explicit ownership for every agent handoff, including which identity can create, task, or terminate a subordinate agent.
Bottom line: AI agent architecture and identity governance are now linked, because the more capable the agent becomes, the larger and harder to manage its identity surface becomes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:25 pm
Every agent type is an identity surface, not just a decision architecture. The article’s taxonomy is useful precisely because it shows how state, planning, learning, and delegation expand the number of credentials, authorisations, and audit events involved. The identity problem is not introduced by AI alone; it appears the moment the system can act beyond a fixed script. Practitioners should treat architecture selection as an identity design decision from the outset.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between delegated access and agent authority?
A: Delegated access means a user authorizes an agent to act on their behalf for a defined scope. Agent authority means the software performs actions under its own operational identity. The distinction matters because blended flows can hide accountability gaps, especially when a single agent uses both user context and service credentials in one task.
👉 Read our full editorial: AI agent taxonomy is also an identity-surface taxonomy