Make the secure choice the default for AI agents

This Cybersecurity Awareness Month, make security the easy choice.

What happens when there’s no user at the keyboard?

Throughout Cybersecurity Awareness Month, we’ve explored a simple idea: Security works better when the secure way to work is also the easiest way to work.

That principle makes intuitive sense when we’re talking about people. Reduce unnecessary authentication friction, make access consistent as workers move between devices, applications, and workflows, and add stronger assurance when risk warrants it.

But organizations increasingly need to ask another question: What happens when the identity requesting access isn’t human?

AI agents may access applications and information, make decisions, or take actions on behalf of users and business processes. A retail agent might check inventory and initiate a replenishment request, while a financial services agent might review transactions and flag potentially fraudulent activity.

AI agent deployment doesn’t make established identity security principles obsolete. In fact, since they often operate without a person directly initiating every action, unique assigned identities, appropriate authority, and clear accountability become even more important.

For example, an AI agent that summarizes a patient encounter and enters notes into an EHR should have clearly defined authority to prevent it from adding inaccurate information, changing existing records without approval, or accessing unrelated patient data. And a unique digital identity makes those actions traceable to the agent rather than incorrectly attributing them to the clinician.

Non-human identities aren’t new, but agentic AI changes the conversation

Security teams already manage many forms of non-human access, including service accounts, applications, APIs, automation, and other machine identities.

Agentic AI introduces additional considerations because an agent could be given authority to access systems and data and perform multiple actions with varying degrees of autonomy.

As a result, anyone deploying an AI agent must ask questions such as:

• What agent is acting?
• Who or what authorized it?
• What task is it authorized to perform?
• Which systems and data does it need?
• What actions can it take?
• When should that authority end?
• Can the organization reconstruct what the agent did afterward?

These are identity security questions. They’re also governance questions. An effective approach needs to address both.

Start with identity: Know what is acting

A workforce identity is generally associated with an individual human actor. Security teams need an equivalent ability to distinguish between non-human actors.

If multiple agents rely on broad, shared credentials, it becomes difficult to determine which agent accessed a resource, under whose authority, and for what purpose. That makes it harder to investigate incidents, identify excessive permissions, or revoke one agent’s access without disrupting unrelated processes.

An agentic AI identity strategy should help organizations define the authority under which each unique agent identity operates in order to distinguish its activity from that of human users and manage its identity throughout its lifecycle.

Identity and authority aren’t the same thing. An identity answers, “What is acting?” Authority answers, “What is that identity allowed to do, and on whose behalf?” Both need to be clear.

Give the agent enough access to do the right job, not every job

In our previous blog, When risk rises, security should get smarter, not harder, we established that higher-risk human identities shouldn’t automatically receive broad or standing privileges simply because that’s easier to administer.

The same principle applies to AI agents and matters even more when software can act quickly and repeatedly.

An agent may need access to a particular application, dataset, or function to complete a task, but it doesn’t necessarily need persistent access to those resources, or to everything the authorizing user or business process can access.

Security leaders should ask:

• Can access be limited to the specific resources and actions required for the task?
• Can permissions be time-bound or adjusted as the task changes?
• Is the agent inheriting authority from a human user that it doesn’t need?
• Can access be revoked immediately?

For example, an AI agent may need to retrieve vendor information to prepare a recommendation but not access the payment systems employees use to approve the purchase. A maintenance agent may need to read equipment data to create a work order but not change production settings on that equipment.

The goal is to give AI agents sufficient delegated authority to complete their work without turning it into a standing license to do more.

Accountability requires visibility

Granting access is only one part of the identity lifecycle. Security teams also need visibility into what happens afterward.

That becomes especially important when an agent can perform multiple actions across systems. A single request might lead to several tool calls, data lookups, workflow changes, or downstream actions. If those events can’t be connected to a distinct agent identity and the authority under which it operated, the resulting audit trail will be incomplete.

Security leaders should make sure they can determine:

• Which resources an agent accessed and what actions it took
• Whether those actions stayed within the expected scope
• When its access ended or was revoked

In addition to enabling a retrospective investigation, monitoring can support intervention while an agent is operating. An agent that accesses an unfamiliar application, requests data outside its normal scope, or acts at an unexpected volume may warrant additional scrutiny or an immediate reduction in authority.

Human identity programs have long relied on accountability as a security principle. Agentic access shouldn’t become an exception simply because the actor is software.

AI agents will encounter the same messy technology environment humans do

AI adoption doesn’t happen in a simple, pristine environment. Organizations still depend on legacy applications, SaaS platforms, cloud and on-premises infrastructure, specialized systems, and different authentication models. Many critical workflows span several of these environments.

AI agents increasingly need to interact across those environments, just as people do. A healthcare agent might work across scheduling, clinical, and administrative applications. A financial services agent might interact with customer, transaction, and fraud-monitoring systems.

Organizations shouldn’t create a parallel identity security model for AI that ignores the access controls protecting the rest of the enterprise. Identity needs to remain meaningful as access crosses technology boundaries.

That’s where interoperability and Zero Trust principles come in. Access decisions should account for the agent’s identity, its authority, the resources and actions involved, and the surrounding risk. Those decisions should remain enforceable across all systems involved, even when they use different technologies or authentication methods.

Make governance part of deployment, instead of an afterthought

Organizations may be tempted to pilot fast-moving technology and address governance later. For agentic AI, access requirements should be part of the design from the beginning.

Before an AI agent receives access, security leaders should be able to ask five questions:

1. What identity will the agent use? Can the organization uniquely identify it rather than relying on a shared identity?
2. Whose authority is the agent acting under? Is ownership clear, and can the responsible person, team, application, or business process be identified?
3. What is the minimum access required? Can permissions be limited by resource, action, or time? Does the agent need to act, or only retrieve information?
4. Can the organization see what the agent does well enough to monitor and investigate its activity?
5. How does access end? Can credentials, permissions, and delegated authority be revoked when circumstances change?

Answering these questions doesn’t need to slow innovation. The goal is to establish the conditions for responsible, scalable innovation.

From the easy choice to the default choice

Making security the easy choice starts with understanding how people actually work. It means reducing unnecessary authentication friction, supporting access across different technologies, and applying stronger controls when risk increases.

Agentic AI extends that principle in a different direction. An AI agent doesn’t experience access events the way a human does. It doesn’t become frustrated by repeated prompts or appreciate a simpler workflow. But the organization still needs a security architecture that makes appropriate access easy to establish, contain, and revoke.

For people, make the secure choice the easy choice. For AI agents, make the secure choice the default choice.

As the identities interacting with enterprise resources evolve, the underlying objective remains consistent: Know who — or what — is requesting access, give that identity only the access required, and maintain accountability for what happens next.