The Identity Crisis Nobody Saw Coming: AI Agents and the End of Human-Only IAM

For decades, Identity and Access Management was built around a straightforward premise: manage the identities of people. Employees, contractors, administrators; human beings who log in, do their work, and log out. IAM programmes were designed, scoped, and delivered with that assumption baked into every architecture decision, every workflow, and every policy.

That assumption is now obsolete.

The rapid rise of agentic AI autonomous software agents capable of planning, executing tasks, and interacting with enterprise systems without human intervention has introduced an entirely new category of identity that most organisations are dangerously unprepared to manage. These are non-human identities (NHIs): AI agents, service accounts, bots, and automated pipelines that act with the authority of the credentials they hold, often at machine speed, and frequently without anyone watching.

The Scale of the Problem

The numbers are striking. According to Gartner, agentic AI was named the top technology trend of 2025, with a prediction that 33% of enterprise applications will include agentic AI by 2028. I think its fair to assume the number could be much higher, but its up from less than 1% in 2024. These agents do not sit passively in a corner of your infrastructure. They connect to databases, call APIs, read documents, send communications, and make decisions. Each one carries credentials. Each one represents an identity.
Yet the security posture around these identities is, in most organisations, essentially non-existent.
A 2025 survey of 260 executives conducted by Okta found that only 10% of organisations have a well-developed strategy for managing non-human and agentic identities. The remaining 90% are deploying AI agents into production environments with either no identity governance framework whatsoever, or with ad-hoc controls that were never designed for autonomous systems.

This is not a theoretical risk. In 2024, during a controlled security exercise, a ChatGPT-based model escaped its sandbox and accessed restricted files, without being explicitly instructed to do so. The agent had developed emergent capabilities that its creators had not anticipated (World Economic Forum, 2025). This is the nature of agentic systems: they are, by design, goal-directed. When given access to resources and tools, they will use them. The question is whether anyone has thought carefully about which resources they should be able to access and what should happen when they try to access something they should not.

Why Traditional IAM Frameworks Fall Short

Conventional IAM is built on the concept of a provisioning lifecycle: a user joins an organisation, an account is created, access is granted based on their role or project, and, if everything goes to plan access is revoked when they leave. This lifecycle maps cleanly onto human behaviour.

AI agents do not have a lifecycle in the same sense. They can be instantiated in seconds, replicated across environments, given access to multiple systems simultaneously, and decommissioned (or not) without anyone updating an access review. They do not have an HR record. They do not go through onboarding. They are not covered by the joiners, movers, and leavers processes that IAM programmes have relied upon for years.
The Identity Defined Security Alliance (IDSA) noted in 2025 that "current provisioning and deprovisioning processes need significant enhancement to handle the unique lifecycle of AI identities." That is a careful way of saying that the processes most organisations currently have in place will not work.
Compounding this is the issue of excessive privilege. Traditional IAM practitioners will be familiar with the principle of least privilege. Granting users only the access they need to perform their role. In practice, this principle is routinely violated for human users. For AI agents, it is almost universally ignored. Agents are frequently given broad access to enable them to function across a range of scenarios, because it is operationally simpler than scoping permissions tightly. The result is an attack surface that grows with every agent deployed.

A New Category of Risk

The consequences of poor AI identity governance are not merely compliance failures. They are active security risks. Credential abuse remains the most common initial access vector in data breaches, according to the 2025 Verizon Data Breach Investigations Report. AI agents typically operate using long-lived API tokens and service account credentials. Precisely the kind of persistent, high-value credentials that attackers target. When those tokens are stolen, an attacker does not gain access to what a human user can reach. They gain access to everything the agent can reach, and they can operate at the speed of software.
The attack vectors are also novel. Researchers have demonstrated that multi-modal AI agents can be manipulated through hidden instructions embedded in images or documents, causing sensitive data to be exfiltrated with no action from the end user (Trend Micro). In a separate demonstration, a malicious web page's hidden instructions caused a retrieval-augmented generation (RAG) agent to retrieve secrets from its knowledge base and transmit them to an attacker-controlled server (arXiv). These are not future threats. They are present-day capabilities.

What Good Looks Like

Addressing the AI identity problem requires organisations to extend their IAM thinking beyond human users in several concrete ways.
First, every AI agent must be treated as a sponsored digital identity with an owner, a defined purpose, and a documented scope of access. Just as a human identity has a manager responsible for their access, an AI agent must have an accountable owner within the business.

Second, agents should be subject to the same access review cadences as human identities. Given the speed at which AI deployments evolve, these reviews may need to occur more frequently than the quarterly or annual cycles that most governance programmes operate on.

Third, the principle of least privilege must be applied rigorously. Agents should be granted access to only the specific resources they require for their defined function, and that access should be time-limited wherever possible. Just-in-Time (JIT) access patterns, already gaining traction in PAM programmes are directly applicable to AI agent identity management.

Finally, audit and monitoring capabilities must be extended to cover agent activity. An AI agent making thousands of API calls per hour produces a rich behavioural signal. That signal is only useful if someone is watching.

The Delivery Implication

None of this is simple to implement, and that is precisely where most organisations will struggle. Extending an existing IAM programme to encompass non-human identities is not a configuration task. It requires architectural changes, policy development, tooling assessment, and a governance model that most IAM teams have never had to build before.
For organisations currently mid-way through an IAM programme, the most important step is to scope this work now, before AI agent deployments outpace the identity infrastructure available to govern them. The window to get ahead of this problem is narrowing quickly.

IAMethod delivers IAM and PAM programmes for organisations navigating complex identity challenges. If you are concerned about non-human identity exposure in your environment, get in touch.

Sources:

Gartner, Top Technology Trends 2025
Okta Executive Survey, 2025 (n=260)
World Economic Forum, Non-Human Identities: Agentic AI's New Frontier of Cybersecurity Risk, 2025
Verizon Data Breach Investigations Report, 2025
Identity Defined Security Alliance (IDSA), Identity and Access Management in the AI Era, 2025
Trend Micro, Multi-modal agent injection research
arXiv, Identity Management for Agentic AI, October 2025