AI agents enterprise users are entering organizations through multiple doors. Some arrive as approved enterprise tools, others begin as small experiments built by individual teams: an agent that updates CRM records, triages support requests, prepares financial reports, reviews contracts, or moves data between systems.
Once connected, these agents stop behaving like conventional software features. They retrieve information, select tools, interpret context, and execute workflows on someone’s behalf, and become active participants in the organization, sometimes before IT has established how they should be identified, supervised, or removed.
This creates a security question that enterprises will need to answer quickly: if an AI agent can act inside the company, whose authority is it using?
The enterprise already has more machine identities than people
JumpCloud’s Q3 2026 IT Trends Report, based on research among 800 IT leaders in the US and UK, found that non-human identities now outnumber human users in 83% of organizations. One-third reported at least six machine identities for every person.
But just 21% have introduced governance controls for them. Non-human identity is a broader category than AI agents. It includes service accounts, API keys, certificates, OAuth tokens, applications, cloud services, and automated workloads. These identities have accumulated steadily as enterprise technology has become more interconnected.
AI agents add another level of complexity because their behavior is less predetermined. A traditional integration usually performs a specific action when a known condition is met. An agent can interpret a goal, choose between available tools, adjust its approach, and potentially delegate part of the task to another system. This combines machine speed with a form of software judgment, which changes the security model considerably.
Is access expanding faster than accountability?
The quickest way to provide that access is often to let the agent use an employee account, a shared service account, or an existing API key. The workflow begins working, but attribution becomes difficult. Security teams can see that an action occurred without being able to determine whether it was initiated by the employee, the agent, or another tool operating through the same credentials. Because teams cannot always predict which resources an agent might need while completing a multi-step task, they may grant access for the entire workflow rather than for each individual action.
That becomes especially dangerous when agents process external content. A malicious instruction embedded in a document, email, or webpage can steer an agent toward an unintended action while it continues to operate with legitimate credentials. OWASP describes this combination of excessive functionality, permissions, and autonomy as “excessive agency”, one of the central risks in systems that connect language models to real tools.
Governance is already struggling to keep pace. Separate JumpCloud research into agentic identity management found that 66% of organizations give agents as much or more access than employees. More than half lack a centralized way to terminate agent access across systems, while only 17% have assigned a security leader responsibility for agent actions.
Every agent needs its own identity
Ideally, it should describe who owns the agent, why it exists, which systems it can access, which actions it may perform, and how long those permissions remain valid. Credentials should be narrowly scoped and regularly rotated. Activity should be logged under the agent’s own identity rather than buried inside an employee or shared account.
Higher-risk actions, including payments, production deployments, access changes, or the disclosure of sensitive information, may require explicit human approval. Organizations also need a reliable way to suspend an agent immediately and revoke every credential associated with it.
These are increasingly becoming questions of infrastructure and standards. In 2026, NIST launched an AI Agent Standards Initiative that includes research into authentication and identity systems for secure interactions between people, agents, and other agents. OWASP has likewise identified identity and privilege abuse, tool misuse, memory poisoning, and cascading failures among the most important security risks in agentic applications.
Identity alone will not make agentic systems secure. Enterprises will also need runtime monitoring, data controls, output validation, prompt-injection defenses, and clear approval thresholds. Identity provides the foundation that makes these controls enforceable.
AI agents are becoming users of enterprise software. The organizations prepared to scale them will know every agent operating inside their systems, the authority it carries, the person responsible for it, and exactly how to stop it.
