For years, enterprise identity programmes have focused on proving who a user or application is, and then determining what that identity can access. AI agents introduce a more complicated question:
What should an AI agent be allowed to do, on whose behalf, under what conditions, and for how long?
Authentication is an important starting point. It is not the identity strategy.
As AI agents become more capable and increasingly embedded in business processes, organisations need an identity layer that can establish trust, enforce authority, manage privilege and provide continuous accountability.
1. An Authenticated Agent Is Not Necessarily a Trusted Agent
Authentication answers a relatively simple question:
Who or what is this?
For a human user, that might mean validating credentials, a device or a strong authentication factor.
For an AI agent, the answer is more complicated.
An agent may be operating autonomously, acting on behalf of a user, calling another agent, accessing an API or interacting with multiple enterprise systems.
Knowing the agent's identity does not automatically tell an organisation whether the action it is attempting should be permitted.
Consider an AI agent supporting a finance team.
It may legitimately need access to financial reports. That does not mean it should be able to modify payment instructions, approve a transaction or download an entire customer database.
The distinction is important.
Identity establishes who is acting. Authorisation determines what that identity is allowed to do. Governance determines whether that authority remains appropriate.
As agents become more autonomous, organisations need all three.
2. The Real Question Is Not "Can the Agent Access It?"
Traditional access management often starts with a straightforward question:
Does this identity have access to this application?
Agentic systems require a more granular approach.
An agent may need access to a system, but only to perform a particular action.
It may need access only for a limited period.
It may need access only when acting on behalf of a specific employee.
It may need additional approval before performing a high risk operation.
This moves identity towards action level authorisation.
Instead of simply asking:
Can this agent access the finance system?
The organisation needs to ask:
Can this agent perform this specific action, using this specific data, in this context, at this point in time?
That is a very different identity problem.
The identity layer therefore needs to connect authentication with context, policy, privilege and authorisation.
3. AI Agents Need Their Own Identity Lifecycle
One of the most overlooked challenges is lifecycle management.
Employees have established identity processes.
They join an organisation, receive access, change roles and eventually leave. Their access can be reviewed and removed.
AI agents need a comparable lifecycle.
An enterprise should be able to answer:
- Who created the agent?
- Who owns it?
- What business purpose does it serve?
- What systems can it access?
- What permissions does it have?
- What credentials or tokens does it use?
- Who approved those permissions?
- When was its access last reviewed?
- What happens when the agent is retired?
Without this lifecycle, organisations risk creating another form of identity sprawl.
Instead of hundreds of thousands of unmanaged human accounts, enterprises could end up with thousands of agents, service identities, tokens and delegated permissions that nobody clearly owns.
The problem is not simply creating an identity for every agent.
It is being able to govern that identity throughout its entire lifecycle.
4. Delegated Authority Changes the Risk Model
AI agents frequently operate on behalf of people.
That introduces another layer of complexity.
If an employee asks an agent to perform an action, the organisation needs to understand how the employee's authority is delegated to the agent.
The agent should not automatically inherit everything the employee can access.
That creates a dangerous form of privilege amplification.
For example, an employee may have broad access because of their role, but an agent performing a specific task may only need a small subset of that authority.
The identity layer should therefore support controlled delegation, where authority is:
- Explicitly granted
- Limited to a defined purpose
- Restricted by policy
- Time bound where appropriate
- Revocable
- Auditable
This is where traditional IAM concepts such as least privilege, privileged access and dynamic authorisation become increasingly relevant to AI.
The objective is not to make agents incapable.
It is to make their authority deliberate and bounded.
5. Privilege Needs to Become Dynamic
Traditional access models often rely on relatively static roles.
An employee may belong to a role that grants access to a collection of applications and resources.
AI agents challenge this model because their behaviour and context can change rapidly.
An agent that is permitted to read customer information may not be permitted to export it.
An agent allowed to create a support ticket may not be allowed to close an account.
An agent allowed to recommend a payment may not be allowed to execute it.
The identity layer needs to distinguish between these actions.
This is where dynamic authorisation becomes increasingly important.
Access decisions can consider factors such as:
- The agent's identity
- The human or system it represents
- The requested action
- The resource being accessed
- Data sensitivity
- Business context
- Risk level
- Time and duration
- Previous behaviour
- Applicable organisational policies
This creates a more adaptive security model than simply assigning an agent a permanent set of permissions.
6. Every Agent Action Needs an Audit Trail
One of the most important requirements for enterprise AI is accountability.
When an employee performs an action, organisations generally have established mechanisms for recording that activity.
AI agents need the same level of accountability, but with more context.
A useful audit trail should make it possible to understand:
Who initiated the action?
Which agent performed it?
What authority was delegated?
Which policy allowed the action?
What system or data did the agent access?
What action did it take?
What happened as a result?
This becomes particularly important when agents interact with other agents.
A single business request could trigger a chain of automated actions across multiple systems.
Without identity aware logging, tracing responsibility across that chain becomes extremely difficult.
Identity therefore becomes more than an access mechanism.
It becomes part of the organisation's accountability architecture.
7. Agent to Agent Identity Cannot Be an Afterthought
Enterprise AI will not consist of isolated agents.
Agents will increasingly interact with APIs, applications, services and other agents.
That creates an identity chain.
Agent A may request information from Agent B.
Agent B may call an enterprise API.
The API may access a database.
Each step introduces another trust relationship.
If those relationships are not explicitly governed, the organisation can lose visibility into how authority moves through the environment.
This makes machine and non human identity management increasingly important.
Organisations need to understand not only the identity of an individual agent, but also the relationships between:
Human → Agent → Agent → Application → Data
Each transition should have clear trust boundaries and appropriate controls.
The Trevonix Perspective
At Trevonix, we believe the identity challenge created by AI agents cannot be solved by authentication alone.
Authentication establishes a starting point.
The broader identity layer needs to provide the controls that determine how an agent operates after it has been authenticated.
For enterprises preparing for agentic AI, we see five foundations as particularly important:
Agent Identity
Establish unique, attributable identities for AI agents and non human entities.
Delegated Authority
Define exactly what an agent can do on behalf of a person, application or another agent.
Dynamic Authorisation
Move beyond static access towards context aware, action level decisions.
Identity Lifecycle Governance
Treat agents like managed enterprise identities, with ownership, provisioning, review and retirement processes.
Continuous Auditability
Maintain a clear record of identities, permissions, delegated authority and actions across the agent ecosystem.
These foundations allow organisations to move from simply asking whether an AI agent is authenticated to understanding whether its behaviour is authorised, appropriate and accountable.
The technology will continue to evolve.
The governance principles should not.
The Bigger Shift: From Identity of Access to Identity of Action
The emergence of AI agents represents a broader shift in enterprise identity.
Traditional IAM has largely focused on identity and access.
Agentic AI introduces a world where organisations also need to govern identity and action.
That means understanding not only who or what is accessing a resource, but also:
Why is it accessing it?
What is it trying to do?
Who authorised the action?
What level of authority is required?
Should that authority still exist?
This is a natural evolution of identity rather than a replacement for IAM.
Existing capabilities such as authentication, MFA, IGA, PAM, lifecycle management and access governance remain important.
But they need to evolve to account for identities that can act autonomously, operate at machine speed and interact across multiple systems.
Final Thoughts
AI agents will change how organisations operate.
They will also change how organisations think about identity.
The immediate temptation is to focus on authenticating agents and ensuring that each one has a secure credential.
That is necessary, but it is only the beginning.
The more important challenge is building an identity layer that can control authority, privilege, delegation, context and accountability throughout the agent's lifecycle.
The organisations that address this early will be better positioned to adopt AI at scale without allowing autonomy to become an uncontrolled source of risk.
The question is no longer simply:
"How do we authenticate our AI agents?"
It is:
"How do we establish, govern and continuously verify the authority of every AI agent acting across our enterprise?"
That is where the next generation of enterprise identity begins.
