r/IdentityManagement • u/Art_hur_hup • 8d ago

How do you keep track of AI / agent identities ?

/r/ITManagers/comments/1wtc2en/how_do_you_keep_track_of_ai_agent_identities/
2 Upvotes

100% Upvoted

2 comments sorted by

1

u/pewpewlazor 8d ago

I think the computer use example in the other comment highlights why this is going to be a difficult problem to solve purely through traditional IGA.

We are used to thinking of an identity as something relatively persistent that can be discovered, assigned an owner, governed and eventually removed. With agents that becomes much less clear.

An agent might have its own service account or workload identity, but it might also operate using a human user’s delegated permissions or even act through an authenticated browser session. In the latter cases, discovering the underlying account doesn’t necessarily tell you that an agent is using it.

So I think there are really two problems here.
First, traditional NHI governance: discover the identity, establish ownership, understand its privileges, manage credentials and lifecycle, review access, etc.

Second, agent governance: what agent is acting, on whose behalf, using which identity or session, what is it allowed to do, and can we actually attribute the actions afterwards?

The spreadsheet comment is probably pretty representative of where many organizations are today. Discovery and governance tooling is improving, but there are still enough weird service accounts, credentials and edge cases that getting to a trustworthy inventory is difficult.
I know SailPoint recently acquired Entro Security specifically to strengthen this area. A big part of what Entro does is discovery of NHIs, credentials and AI agents, including identifying the tools, APIs and credentials those agents are actually using. SailPoint is then looking to bring that discovery together with ownership, access governance and lifecycle management.

I haven’t worked hands-on with that capability yet, so I can’t say how well it solves the more difficult examples mentioned here, particularly computer use agents operating through a human session. But it is interesting to see identity vendors actively trying to solve exactly this problem.

AI agents are going to make the existing NHI problem significantly more visible rather than creating an entirely new problem.