Enterprise software security has long depended on a familiar question: Which person or application is making this request? AI agents make the answer harder. An agent may interpret a goal, choose among tools, call another agent and take a series of actions that no employee specified one by one.
That autonomy turns identity into basic infrastructure. A company needs to know which agent acted, which user or team authorized it, what version was running, what permissions it had and which evidence shaped the decision.
The National Institute of Standards and Technology has placed those questions at the center of its work on agent security. A 2026 concept paper from NIST’s National Cybersecurity Center of Excellence focuses on applying identity and authorization practices to software and AI agents. NIST’s later analysis of industry comments found broad agreement that traditional cybersecurity principles remain useful but need to be adapted for agent-specific threats.
An agent is not just another service account
Traditional service accounts generally perform predefined operations. An agent can decide which operation appears useful based on changing context. That flexibility creates risk when permissions are broad or when several ordinary permissions can be combined into a consequential action.
An agent with access to email, customer records and a payment system may have everything it needs to resolve a legitimate request. It may also have enough access to disclose sensitive data or act on a manipulated instruction. The security model has to account for the sequence, not only each individual call.
Organizations should assign each production agent a distinct identity instead of allowing a fleet to share credentials. The identity should be tied to an owner, an approved purpose and a defined permission set. It should be possible to disable the agent without disrupting unrelated services.
Permissions should be contextual and temporary
Least privilege becomes more important when software can plan. An agent should not retain permanent access to every tool it may need someday. High-risk permissions can be granted for a particular assignment, limited to a transaction threshold or conditioned on human approval.
Context matters as well. Reading a contract may be allowed, while sending it outside the company is not. Drafting a refund may be automated, while issuing it above a certain amount requires review. The authorization layer should understand these differences instead of treating access as a simple yes-or-no decision.
Google’s Gemini Enterprise Agent Platform illustrates where vendors are heading. Its announced Agent Identity capability assigns a cryptographic identity, while Agent Registry and Agent Gateway are designed to centralize approved agents, tools and connections. Other enterprise platforms are developing similar controls because customers increasingly expect an agent fleet to be manageable like other critical infrastructure.
An audit trail must explain the chain
Logging the final action is not enough. Investigators need the chain: the original goal, sources consulted, tools called, approvals received, intermediate results and policy applied. That record should be protected from alteration and retained according to the risk of the workflow.
The goal is not to expose every internal model calculation. It is to preserve enough operational evidence to reproduce the event and determine where the system failed. Did the agent receive a malicious instruction? Did it use an outdated policy? Was a connected tool misconfigured? Did a human approve a step without seeing the relevant warning?
Accountability remains human
Identity and logs make responsibility visible, but they do not replace it. Every agent needs a business owner accountable for the outcome and a technical owner accountable for operation. High-impact workflows also require security, legal or compliance review.
Companies should resist language that treats an agent as an independent employee. Software does not carry legal or managerial responsibility. The organization that deploys it still owns the consequences.
The enterprises that move fastest will not be those that give agents the broadest access. They will be those that can grant narrow authority confidently, observe what happens and adjust controls without rebuilding the entire system. Identity, permission and evidence are what make useful autonomy possible.