Background
A new type of identity – without an employment contract
Seen from the identity platform, an AI agent is simply another identity: it has accounts, tokens, and access, and it acts in your systems. The difference is pace. Agents are created in minutes, copied freely, work around the clock – and have no leaving date that automatically closes their access.
Most organizations cannot answer four basic questions today: Which AI agents do we have? Who is accountable for them? What can they reach? And what is the risk? These are exactly the questions IGA has answered for employees and service accounts for years – they just need to be asked of a new type of identity.
Principles
Five IGA disciplines that apply to AI agents too
- Ownership: every agent has a named, accountable owner – no orphaned agents.
- Lifecycle: agents are created, changed, and retired through a controlled process, just like employee on- and offboarding.
- Least privilege: the agent only gets the access its task requires – not a broad service account because it is convenient.
- Recertification: access is reviewed at fixed intervals and compared with what the agent actually uses.
- Traceability: what the agent has been given access to, and why, can be documented, and critical actions require human approval.
The vendors are moving
Both of our product partners have taken up the challenge. In June 2026, Omada launched Omada Agent Governance – a solution that discovers AI agents and non-human identities across cloud platforms, assigns ownership, compares access with actual usage, and supports documentation against frameworks such as the EU AI Act, NIST AI RMF, and ISO 42001.
Pointsharp approaches the task from the access side: AI agents are treated as governed identities with an owner, a lifecycle, approval flows, and least-privilege access, and access policies are enforced before the agent reaches applications, APIs, and MCP servers. Critical actions stay under human control with approval steps and a full audit trail.
The direction across the market is clear: AI agents should not be governed in a separate tool on the side – they belong in the same identity governance as the rest of the organization.
Where should you start?
Not with a new product. Start with the overview: which agents and service accounts already exist in your environment, who owns them, and what access do they have? For most organizations the answer is uncomfortably unclear, and that usually applies to the classic non-human identities that have stayed under the radar for years, too.
If you already run an IGA platform, the foundation is in place: the same processes for ownership, approval, and recertification can be extended to agents. If you do not, AI agents are one more reason to get identity governance in order now – because the number of identities only grows in one direction.
Is your identity platform ready for AI agents?
We help you map your identities – people, service accounts, and agents – and set out a governance plan that lasts. Start with an IAM Maturity Assessment.
