How to Secure AI Agents and Their Identities

TL;DR

Secure AI agents by giving every instance a unique identity, removing standing privileges, granting session-level access only when needed, and checking authorization at the final connection to sensitive resources. Complete protection also requires intent-based delegation, end-to-end audit records, policy governance, orchestration, and shared observability across security, IT, and development teams.

Transcript

Hey everybody, we're here to talk today about probably the most white hot topic in IT today. And that is agentic AI, in particular, how you actually deploy agentic AI with agentic runtime security. This topic begins and ends really with identity and access management. And the reason that's causing a lot of problems right now. Is because when you ta... Read More

Key Insights

• Agentic AI is a non-human identity because an agent is a software workload, such as TypeScript or Python code, running on infrastructure including containers, Lambda, or virtual machines and receiving an identity to access other systems.
• Non-human identities are estimated in the discussion to outnumber human identities by roughly 45 to 90 for every human identity, greatly expanding the identity-related surface that organizations must register, govern, observe, and audit.
• Traditional human-centered identity management often protects only the connection from a user or application to the first agent. Embedded agents can continue toward databases, mainframes, and other sensitive resources without equivalent controls across the full chain.
• Accountability requires a unique identifier for every agent instance so its behavior can be traced precisely. If an agent inherits and impersonates a user's identity, security records cannot reliably distinguish the agent's actions from the user's actions.
• Least privilege for agents requires stripping standing permissions and issuing dynamic privileges only for the necessary request, action, and session. An HR agent, for example, should not retain continuous authority to onboard or off-board employees.
• Secure delegation ties a user's request, the selected agent, and the intended action into one auditable workflow. This connection becomes especially important when agents perform banking transactions, transfer funds, or provision infrastructure in cloud and on-premises environments.
• Last-hop enforcement checks each external connection near real time at the point of use. Authorization granted when an agent was deployed one or two months earlier is insufficient for deciding whether a specific action is permitted in the current session.
• Agentic runtime security depends on orchestration, governance, and observability working together. These capabilities direct identity flows, apply policies, provide proof of control, expose posture and threats, and give security, IT, and development teams a shared view of risk.

Questions & Answers

Q: How do you secure non-human identities used by AI agents?

Secure non-human identities by registering every agent, assigning each instance a unique identifier, quantifying its risk, and removing all standing privileges. Grant only the permissions required for a specific request, action, and session. Tie delegated activity to the user's intent, enforce authorization at each external connection, and retain an audit trail spanning the human, application, agents, actions, and responses.

Q: Why do traditional IAM controls leave AI agents exposed?

Traditional identity and access management is centered on human identities and often secures the path only as far as the first agent invoked by an application. The protection can break down when that agent calls embedded agents and sensitive back-end resources. This creates gaps in accountability, privilege control, delegation, impersonation detection, and authorization at the final connection to a database or mainframe.

Q: What are the main identity security risks for AI agents?

The central risks are missing accountability, excessive privilege, unsafe delegation, user impersonation, and weak last-mile enforcement. An unidentified agent cannot be traced, while an overprivileged agent can retain unnecessary authority. Delegation without recorded intent obscures responsibility, impersonation hides whether a user or agent acted, and shared or standing credentials can leave sensitive back-end access difficult to evaluate and revoke.

Q: How should least privilege work for an AI agent?

Least privilege for an AI agent should be dynamic rather than based on long-lived role access. All privileges are stripped by default, then the agent receives only the permission needed for the current request and action at the session level. An HR agent may temporarily receive authority to onboard or off-board an employee, but it should not keep that authority whenever the agent is running.

Q: Why should every AI agent have a unique identity?

A unique identity makes each agent instance accountable and allows its actions to be traced. Without one, an agent may inherit the identity of the user who invoked it and operate as that person. Although the task may succeed, the audit record can no longer show whether the user or the agent performed the action, undermining investigation, governance, and proof of control.

Q: What is the last-mile security problem for AI agents?

The last-mile problem occurs when an agent connects to a sensitive resource such as a database or mainframe without a fresh authorization check at the point of use. Agents may share database credentials, hold standing privileges, or act at machine speed. Security must analyze every external connection near real time and determine whether that specific action is authorized in the current context and session.

Q: What are the five security imperatives for deploying AI agents?

The five imperatives are registering agents, stripping standing privileges, tying actions to user intent, enforcing policy at the point of use, and producing proof of control. Together, they establish identity, enable session-level access, preserve delegated accountability, verify each last-hop connection, and create an end-to-end audit record covering human identities, non-human identities, actions, and responses.

Q: Which capabilities support agentic runtime security?

Agentic runtime security requires orchestration, governance, and observability across human and non-human identities. Orchestration manages interactions and directs traffic between identities. Governance applies access and last-hop policies while supporting proof of who did what. Observability covers posture management and threat management, reveals fragmented practices such as numerous secrets managers, and helps security, IT, and development teams collaborate around shared risks.

Summary & Key Takeaways

• Agentic AI creates an identity and access management challenge because agents are non-human identities that can call other agents and sensitive back-end resources. Human-centered controls often protect only the path from a user to the first agent, leaving embedded agents and subsequent resource connections without sufficient accountability, authorization checks, or auditability.

• The proposed security model registers every agent, removes standing privileges, grants dynamic access at the session level, ties delegated actions to the requesting user's intent, and enforces policy at the point of use. These controls address overprivilege, impersonation, unclear delegation, shared credentials, and unverified last-hop access to sensitive systems.

• Secure deployment depends on orchestration, governance, and observability working across human and non-human identities. Orchestration directs identities and actions, governance applies policies and supports proof of control, while observability exposes security posture and threats. Security, IT, and development teams must use this visibility to coordinate risk management throughout the agent lifecycle.