1. What\u2019s the problem? (The identity vacuum)<\/p>\n
The core problem is that AI agents currently operate in an Identity Vacuum. In most production environments, agents are given ambient, inherited access. They run as service accounts with broad permissions or, worse, inherit the full permissions of the human user who triggered them.<\/p>\n
This creates three critical vulnerabilities:<\/p>\n
The Action-Based Threat Model: Unlike traditional apps, agents \u201cdo\u201d things. If an LLM is tricked via prompt injection, it doesn\u2019t just display a wrong answer; it executes a malicious tool call. 80% report seeing apps act outside of intended boundaries<\/a>.<\/p>\n The RAG Attack Surface: Retrieval-Augmented Generation (RAG)<\/a> systems are vulnerable to indirect prompt injection. If an agent fetches a document containing malicious instructions, that document becomes the new \u201cmaster\u201d of the agent, overriding developer guardrails.<\/p>\n Non-Human Identity (NHI) Explosion: We are seeing a massive surge in APIs, services, and autonomous agents that lack a centralized source of truth for identity. 39% report unauthorized access incidents<\/a> with agents, and most teams have no way to revoke an individual agent\u2019s access without breaking the entire service.<\/p>\n Anthropic\u2019s Claude Mythos discovery recently highlighted the stakes<\/a>. The model identified thousands of zero-day vulnerabilities across major OSs and browsers, including bugs that had survived 20+ years of human review.<\/p>\n This matters because AI is now a force multiplier for vulnerability discovery. While AI can find bugs at machine speed, humans still remediate them at a \u201chuman pace\u201d (meetings, backlogs, patch cycles).\u00a0<\/p>\n \u201cWhile AI can find bugs at machine speed, humans still remediate them at a \u2018human pace.’\u201d<\/p>\n If your IAM infrastructure is homegrown or unmanaged open source, you cannot patch fast enough to keep up with an AI-powered attacker. Identity is the most exposed layer because it is the control plane; if the agent\u2019s identity is compromised, the entire infrastructure is open for lateral movement. SailPoint research reports 33% have seen agents inappropriately handle restricted data<\/a>.<\/p>\n 3. How do I fix the problem? (The agentic IAM blueprint)<\/p>\n Fixing agentic security requires moving the guardrails from the LLM prompt to the infrastructure. You cannot talk an agent into being secure; you must authorize it to be secure. Compounding the agentic problem, the majority of EMA survey participants do not believe their IAM solutions are ready<\/a>:<\/p>\n 62% state not ready for agentic resiliency<\/p>\n 49% claim not ready for agentic compliance<\/p>\n 62% report not ready for agentic scale<\/a><\/p>\n 59% disclose not ready for agentic security<\/p>\n \u201cYou cannot talk an agent into being secure; you must authorize it to be secure.\u201d<\/p>\n Treat agents as first-class identities<\/p>\n Agents must be treated as first-class non-human Identities. This means:<\/p>\n Authentication: Agents should authenticate against an Identity Provider using scoped credentials.<\/p>\n Short-lived tokens: Use OAuth2 to issue tokens that are interaction-scoped. If an agent is compromised, the token expires quickly, limiting the window of exploitation.<\/p>\n Relationship-based access control (ReBAC): Use a graph-based permission model to define exactly what an agent can touch.<\/p>\n Align retrieval with authorization<\/p>\n In RAG systems, the \u201cview\u201d permission must match the \u201cretrieval\u201d permission. Before an agent fetches a document to place in its context window, the system must check: Does this specific Agent ID have permission to view this Document ID? If not, the document is never retrieved, preventing the agent from ever seeing and being influenced by malicious payloads.<\/p>\n Engineers as conductors<\/p>\n Shift your engineering mindset. Stop trying to hard-code every agent action. Instead, act as a conductor, orchestrating agents through Policy as Code. Use tools to visualize these complex permission chains so you can see exactly how an agent\u2019s relationships resolve to ALLOW or DENY.<\/p>\n 4. \u201cGotcha\u201d problems & how to avoid them<\/p>\n Even with a solid plan, several hidden costs<\/a> and technical traps often emerge:<\/p>\n The inherited access trap:<\/p>\n Problem: Developers often give agents Admin rights to simplify development.<\/p>\n Fix: Implement Least Privilege Access from day one. If an agent only needs to read Marketing docs, don\u2019t give it access to the whole S3 bucket.<\/p>\n The feedback loop delay:<\/p>\n Problem: As you add security layers, agent latency increases, leading users to bypass security for speed.<\/p>\n Fix: Use high-performance permission engines that can resolve complex queries in milliseconds, ensuring security doesn\u2019t buffer the user experience.<\/p>\n The ghost agent problem:<\/p>\n Problem: Agents are created for a task, the task ends, but the credentials remain active.<\/p>\n Fix: Implement automated lifecycle management. Use Token Chain Revocation so that if a parent orchestrator agent is flagged, all child agent tokens are instantly invalidated.<\/p>\n Visual blindness:<\/p>\n Problem: Permission models for hundreds of agents become too complex to hold in a human brain.<\/p>\n Fix: Use visualization tools to audit your models. If you can\u2019t see the graph, you can\u2019t secure the graph.<\/p>\n Summary: Identity is where you start<\/p>\n Security is a process, not a product. While LLM guardrails and prompt hardening are important, they are easily bypassed. The only hard boundary that stays firm in the face of an autonomous agent is the Authorization Boundary.<\/p>\n Treat your agents as identities, scope their world with ReBAC, and ensure your IAM stack is professionally managed to keep up with the AI-driven pace of discovery. The future of the internet is agentic; make sure your security is too.<\/p>\n
![](\"https:\/\/thenewstack.io\/wp-content\/uploads\/2026\/05\/1fab2efa-justin_headshot-600x600.avif\"\/)
<\/p>\n