Why AI Agents Need Continuous Identity Controls

Enterprise identity systems were built for people who sign in, complete tasks and end a session. AI agents and automated workflows are changing that model by acting across cloud environments, code repositories, APIs and internal systems after initial access has been granted.

That shift creates a security challenge: organizations need to understand what software actors do, what they can access and whether their actions remain authorized. Traditional identity and access management (IAM) tools often validate credentials at login, while agents can continue making decisions, invoking tools and changing systems.

The article identifies several related risks. Stolen or compromised credentials can let attackers appear legitimate. Shadow AI, short-lived credentials and machine-driven actions add to the attack surface. Organizations may also lack an inventory of their agents, their data access, their owners and the actions they take. Long-lived secrets, shared credentials and broad delegated access pose further concerns when used by autonomous tools.

The proposed response has three parts: identify agents and assign ownership; evaluate trust in context as actions happen, so risky behavior can be contained; and make identity management work across APIs, terminals and orchestration layers, not only administrative consoles. These controls should maintain accountability to a human owner or policy decision.

TechRadar contributor Russ Kirby argues that the goal is to govern AI use without stifling it. The article is part of TechRadar Pro Perspectives, and the views are Kirby’s, not necessarily those of TechRadar Pro or Future plc.