Back to Blog
You’ve invested in IGA, PAM, and Zero Trust. But now you’re wondering how many of those controls apply to your AI agents. If the answer isn’t “all of them,” you have a gap that your adversaries may already be positioned to exploit.
Key findings
- Non-human identities now outnumber human identities 80:11 in the average enterprise, yet 92%2 of AI agent deployments have no access review or recertification cycle.
- Existing IGA, PAM, and SoD frameworks were not designed for AI agents. Each has a structural gap that may be exploited by adversaries via agent behavior.
- A single orchestrating agent can invoke sub-agents whose combined permissions violate SoD rules without triggering a single conflict-detection alert.
- Context & Intent-Aware Access Management (CIAM) evaluates not just whether an agent has permission, but whether it should act at this moment for this specific purpose.
- A 90-day phased roadmap, from agent discovery through board-level reporting, gives CISOs a defensible governance posture without blocking AI adoption.
The non-human identity explosion
AI agents should not be treated like Service Accounts. They are autonomous, credentialed actors that authenticate across multiple systems, make context-dependent decisions, and execute multi-step workflows at machine speed without continuous human oversight. They represent a new class of principal that most existing identity frameworks were not designed to fully govern.
|
>> CISO SIGNAL If your NHI hygiene is already lacking (orphaned service accounts, embedded secrets, static tokens, etc.) AI agents will amplify every one of those failure modes at scale. |
Where your identity stack breaks down
The failure modes are structural, not incidental. Patching them requires architectural change rather than incremental policy updates.
IGA: No HR hook for agent lifecycle
Agents are instantiated by developers, cloned for parallel runs, and decommissioned by stopping a process. None of their lifecycle events surface in traditional IGA platforms. As a result, agents accumulate access without recertification, a birthright definition, or a deprovisioning trigger.
PAM: Built for humans, not unattended pipelines
PAM assumes there’s a human behind the keyboard. This often leaves AI agents running unattended as they’re invoked thousands of times each day and conflicting with session check-in delays. Most PAM architectures lack a native model for agentic credential brokering, which leaves the problem to compound over time.
Access certification: Can't certify what it can't see
AI agents remain largely ungoverned by managers in the HR system. Certification tools provide access in a role-based format, but this doesn’t help govern agents that require API scope or OAuth claim language to restrict their access. Certifiers are often asked to approve access they cannot meaningfully interpret, leading to overpermissioning and potential risk down the road.
SoD: Blind to cross-agent permission aggregation
A single orchestrating agent can invoke sub-agents whose combined permissions span a full restricted transaction, defeating SoD rules without triggering a single conflict-detection rule.
Zero Trust: No verification without authentication
API keys and OAuth client credentials often lack behavioral baselines, device postures, and step-up capabilities, and most enterprises haven’t established the policy primitives for zero-trust with AI agents.
The AI agent threat surface
AI agents introduce attack vectors that differ qualitatively from threats posed by human identities. Most SOC playbooks are not currently designed to detect them.
|
Severity |
Risk |
Description |
|
CRITICAL |
Credential Exfiltration & Agent Takeover |
Compromised API keys or OAuth tokens grant attackers full access to all systems the agent interacts with, often bypassing detection methods designed for human behavior. |
|
CRITICAL |
Prompt Injection & Semantic Hijacking |
Malicious instructions embedded in documents or emails that the agent processes can override its behavior. Existing WAF, DLP, and SIEM rules often lack visibility into the semantic layer where this attack operates. |
|
HIGH |
Privilege Escalation via Agent Chaining |
A low-privilege orchestrator invoking high-privilege sub-agents effectively escalates beyond its own credential scope. Traditional escalation detection also lacks a model for cross-agent permission aggregation. |
|
HIGH |
Lateral Movement via Broad Integration |
Agents connected to CRM, ERP, HRIS, and cloud storage simultaneously are a single compromise away from lateral movement that exceeds anything a human account pivot typically enables. |
|
MEDIUM |
Exfiltration via Legitimate Scope |
An agent with wide read access might unintentionally combine sensitive data, effectively causing exfiltration without malicious intent. |
|
MEDIUM |
Orphaned Agent Credentials |
Agents decommissioned without formal offboarding leave active credentials in target systems indefinitely. Unlike orphaned human accounts, HR delta to trigger detection is often missing. |
|
SOC Coverage Gaps: Check these against your current detection ruleset
|
The NHI identity governance framework
Your identity fabric must expand to cover non-human identities. NHI governance doesn’t replace IGA or PAM. Rather, it serves as a framework and connecting force that enables your application for AI agents.
Start with discovery: You cannot govern what you cannot see
The first step is a comprehensive audit and identification of all agents within your environment, including those deployed by specific teams, embedded within SaaS platforms (such as Copilot, Agentforce, ServiceNow), and any shadow deployments. For each agent, create an authoritative record that details the agent ID, owner, mandate scope, credential inventory, access footprint, lifecycle status, and the most recent review date.
What do secure AI agent credentials look like?
|
AGENT CREDENTIAL MINIMUMS credential_type → Short-lived OAuth2 tokens | SPIFFE SVIDs | mTLS certs max_token_lifetime → 15 min (interactive) | 1 hour (batch) | Never unlimited scope_binding → Per-task resource scope | No wildcards | Explicit allowlist secret_storage → PAM vault or secrets manager | Never env vars or config files rotation_policy → Automated | Triggered on anomaly | No manual rotation |
IGA extension: Six capabilities to strengthen your approach
PAM and Zero Trust adaptations for AI agents
Instead of storing them in agent configurations, broker them at task time and record agent workflow execution (including the input-output chain, not just keystrokes). For zero trust, enforce policy at the API call level, not the session level, using workload attestation, task scope verification, and data classification awareness as the verification primitives.
What is context and intent-aware access management (CIAM)?
Traditional IAM focuses on whether a principal has permission to access a resource. CIAM considers whether the principal should take action at this moment for this precise purpose. For AI agents, intent-based evaluation offers control that genuinely mitigates risk.
CIAM continuously checks each access request against five context dimensions and an intent claim at the API level, rather than only at session start.
|
Dimension |
Context Signal |
What It Captures |
Access Effect |
|
Operational |
Task type, workflow phase, upstream trigger |
Is this access consistent with the agent’s declared task and workflow sequence? |
Deny or flag if the task type does not justify the resource request. |
|
Data |
Classification, volume, recipient, downstream action |
Is the data sensitivity and volume proportionate to the stated purpose? |
Step-up approval required for regulated or high-classification data. |
|
Temporal |
Time of day, business calendar, change windows |
Is this access occurring at a time consistent with the agent’s normal profile? |
Anomalous-hour access triggers human notification or suspension. |
|
Behavioral |
Deviation score vs. baseline, velocity, and access pattern |
Does this request deviate from the agent’s established behavioral fingerprint? |
High deviation triggers real-time risk escalation or throttling. |
|
Environmental |
Deployment env, compute attestation, invocation source |
Is the agent running from expected infrastructure, invoked by an authorized source? |
Deny if the workload attestation fails or the invocation source is unrecognized. |
Intent declaration: The new access control primitive
Agents must submit a structured intent claim detailing the task, data scope, action type, and recipient before accessing sensitive resources. The PDP checks this claim against the agent’s mandate before approval, applying PAM break-glass logic as a standard control at machine speed.
|
INTENT CLAIM SCHEMA agent_id → agt_fin_reporting_v2.3 task_declaration → Q3_EXECUTIVE_BRIEFING_PREPARATION target_resource → finance.dw.quarterly_results | classification: CONFIDENTIAL intent_type → READ_AGGREGATE | no PII | no external transmission data_scope → revenue_by_region, opex_summary | date_range: 2025-Q3 mandate_ref → MANDATE-2025-FIN-007 | approved: CFO | valid_until: 2025-12-31 |
Risk-adaptive access: Dynamic tightening by context score
|
Risk Score Range |
Access Decision |
Step-Up Required |
Example Scenario |
|
0–24 Low |
Permit + standard log |
None — automated execution |
Routine pull matching mandate, normal hours, baseline behavior |
|
25–49 Elevated |
Permit + enhanced audit |
UEBA alert raised; reviewed within 24h |
Data volume 40% above baseline; task within mandate |
|
50–74 High |
Throttled + hold |
Async human approval; 4-hour window |
PII in scope not declared in intent claim; marginal attestation |
|
75–100 Critical |
Deny — immediate block |
Synchronous CISO alert; agent suspended |
Cross-agent escalation detected; intent inconsistent with pattern |
Least-intent privilege: Going beyond least privilege
While least privilege limits access for agents, least-intent privilege restricts actions to specific purposes. For example, using customer records for support differs from using them for marketing, as clarified by intent claims enforced by the PDP.
|
CIAM READINESS CHECK (1) Does your PDP support ABAC with real-time context signals? (2) Can your context aggregation layer feed normalized signals at sub-second latency? (3) Is your agent mandate registry machine-readable and API-accessible? (4) Can your PAM inject task-scoped credentials conditional on PDP approval? (5) Do your audit logs capture intent claims alongside access decisions? Each “no” is a CIAM implementation gap. |
Observability and incident response for AI agents
The effectiveness of governance depends on transparency. For AI agents, this means going beyond the list of called APIs to understand why each API is being used.
Semantic audit trails
Each agent action log must capture the agent’s identity and credentials, task context and goal, input received, reasoning for decisions, action taken, and anomaly flags. Since it’s difficult (if not impossible) to gather this information retroactively, your audit trails should be built into the deployment lifecycle.
Behavioral baselines
Adjust your UEBA to monitor agent behavior, including typical API usage, target systems, data quantities, and timing patterns. When an agent connects to systems beyond its usual scope, this should be viewed as a significant indicator rather than mere background noise.
IR playbooks: the minimum viable set
- Credential compromise: cascade revocation SLA, blast radius assessment, forensic collection
- Prompt injection: agent isolation, input source analysis, semantic log review
- Scope expansion: entitlement review trigger, access footprint diff, root cause determination
- Orphaned credential: immediate revocation, historical log review for anomalous usage
- SoD violation via chain: workflow freeze, cross-agent permission analysis, compliance notification
The CISO action plan: A 90-day roadmap to defensible AI governance
From zero visibility to a defensible governance posture in six phases.
|
Phase |
Timeline |
Actions |
|
Phase 1 |
Days 1–14 |
Agent Discovery & NHI Inventory Active scan across cloud, SaaS, and on-prem. Pull OAuth registrations, enumerate API keys, and survey dev teams. Build initial NHI registry. A 60% complete inventory with automation beats a perfect spreadsheet that goes stale. |
|
Phase 2 |
Days 15–30 |
Risk Stratification & Quick Wins Rank agents by access footprint, data sensitivity, and credential hygiene. Immediately rotate long-lived credentials, assign owners to unowned agents, and right-size the top 10% most over-provisioned. |
|
Phase 3 |
Days 31–45 |
IGA & PAM Extension Define agent entity types in your IGA data model. Build agent-owner certification workflows. Extend SoD rules to agent chains. Configure PAM brokering for high-risk agents or implement Secrets Manager as an interim solution. |
|
Phase 4 |
Days 46–60 |
Detection & Observability Configure UEBA behavioral baselines for top-risk agents. Write detection rules for the five SOC coverage gaps. Enable semantic audit log collection. Publish IR playbooks for agent-specific incident types. |
|
Phase 5 |
Days 61–75 |
CIAM Foundation Deploy an intent-aware PDP with ABAC context evaluation. Build a machine-readable mandate registry. Instrument high-risk agents with intent claim submission. Run risk-adaptive policy pilot on most sensitive data resources. |
|
Phase 6 |
Days 76–90 |
Policy, Governance & Board Reporting Formalize AI agent security policy. Run the first NHI access certification campaign. Build board-level narrative with five key metrics (see below). |
|
FIVE BOARD METRICS FOR AI AGENT GOVERNANCE (1) NHI inventory completeness % — coverage of the agent population under governance. (2) Over-provisioned NHI credential ratio — access exposure quantified. (3) Mean time to revoke for agent credential incidents. (4) CIAM coverage % — proportion of high-risk requests evaluated by intent-aware policy. (5) Risk-adaptive access interventions per week — how often the system auto-tightens based on context signals. |
The governance imperative: Why CISOs who lead on AI agents win
“The organizations deploying AI at scale in 2027 are not the ones moving fastest today. They are the ones building identity governance infrastructure now that makes fast, safe deployment possible. Speed without governance is just a faster path to a breach."
CISOs who block AI adoption lose the argument today and the room tomorrow. CISOs who govern it become the reason their organization can move fast without losing security. Identity governance isn’t necessarily a tax on AI adoption; it is the infrastructure that makes scale possible and the evidence that makes it defensible.
The regulatory pressure makes this a deadline, as opposed to a preference. The EU AI Act, NIST AI RMF, and SEC disclosure obligations aren’t limited to rewarding documented governance programs; they increasingly penalize the absence of one. Auditable controls are becoming table stakes for any organization deploying AI at scale.
But the stronger argument isn't compliance. It's exposure. Right now, AI agents are operating inside your enterprise with real credentials, real permissions, and real access to sensitive systems — and most identity stacks weren't built to see them, let alone govern them. They have credentials your IGA doesn't manage, permissions your PAM doesn't broker, and behavior your SOC has a limited baseline for.
That gap is not theoretical. It represents an emerging attack surface and may increase the likelihood of future incidents if not addressed. Close it before your agents define your next incident (or your next disclosure).
Learn more about our KPMG & Saviynt alliance here.
Frequently asked questions about AI agent identity governance
Citations:
- CyberArk, The Seven Types of Non-human Identities to Secure
- Sonrai Security, Why 92% of Cloud Permissions Are Never Used, and What That Costs You
Raj Behal
Managing Director, Cybersecurity and Technology Risk
KPMG
Email: rbehal@kpmg.com
-1.png)
Report
Saviynt Named Gartner Voice of the Customer for IGA
EBook
Welcoming the Age of Intelligent Identity Security
Press Release
AWS Signs Strategic Collaboration Agreement With Saviynt to Advance AI-Driven Identity Security
Solution Guide