Enterprise security has spent decades answering a relatively simple question:who is allowed to do what? Traditionally, the answer involved employees, usernames and permissions. AI agents are making that model considerably more complicated.
Organizations are beginning to deploy agents capable of accessing corporate data, calling APIs, using credentials and taking actions across multiple systems. Yet many companies do not have a reliable inventory of those agents, know who owns them or understand exactly what they can access. This is pushing identity from a traditional security function toward something more fundamental: the control plane governing trust in agentic environments.
The Number of Non-Human Identities Is Exploding
The scale of the problem is already significant. Research cited by SiliconANGLE suggests organizations manage an average of 109 machine identities for every human identity, while AI agent identities are expected to increase sharply over the next year.
The permissions attached to them are equally concerning. SailPoint research found that 97% of AI agents have access to sensitive data, while only 21% of organizations report high confidence in their ability to manage agent security risks. In one proof of concept at a Fortune 500 company, more than 10,000 previously unknown AI agents were reportedly discovered.
The emerging problem resembles shadow IT, but it can spread much faster. Employees can deploy AI tools, coding agents and automated workflows without security teams necessarily knowing that another machine identity has effectively entered the organization.
Agents Make Old Identity Problems More Dangerous
Excessive permissions are hardly new. Employees accumulate access as they change roles, service accounts are forgotten and API keys remain active long after their original purpose disappears.
AI agents can amplify those weaknesses because they operate at machine speed. An overprivileged human might occasionally access something they should not; an autonomous agent can potentially exercise those permissions thousands of times within hours.
Agents can also spawn subagents, reuse credentials and combine access across different systems. When something goes wrong, determining who was responsible becomes difficult if the activity ultimately appears in logs under an obscure service account.
This makes ownership as important as authentication. Security teams need to know not only that an agent has a valid identity, but which human or business function is accountable for it.
Sandboxing Alone Doesn’t Solve the Problem
Much of agent security currently focuses on containment through sandboxes, secure runtimes and policy enforcement. Those controls are essential, but they answer only part of the question.
A sandbox can prevent an agent from reaching a prohibited network. It cannot determine why the agent exists, who created it, which corporate data it should access or when its permissions should expire.
That is where identity becomes critical.
The emerging architecture combines containment with identity governance: agents receive unique identities, permissions are limited to specific tasks, access can expire automatically and every agent remains connected to a human owner.
Standing privileges become particularly problematic in this environment. Instead of giving agents permanent credentials, organizations can increasingly move toward just-in-time authorization, granting access only when a task requires it and removing that access afterward.
Identity Becomes Infrastructure for Agentic AI
SailPoint is betting heavily on this transition with its Agentic Fabric platform, designed to discover AI agents and machine identities, associate them with human owners and enforce authorization policies. Its capabilities include detecting hidden agents and MCP servers, controlling access to sensitive information and providing mechanisms to revoke rogue agents.
But the broader trend extends beyond any individual vendor.
As organizations deploy larger numbers of autonomous systems, they will need to treat agents as first-class identities alongside employees and conventional machine accounts. That means maintaining inventories, assigning ownership, applying least privilege, monitoring activity and having a reliable way to immediately revoke an agent’s credentials.
The security model therefore shifts from asking whether an AI model itself can be trusted to asking something more operational:what is this agent allowed to do right now?
In an environment where thousands of autonomous systems may eventually operate on behalf of humans, identity becomes the mechanism connecting AI capability with accountability. Sandboxes can contain agents and monitoring systems can detect suspicious behavior, but identity determines who the agent is, what authority it possesses and how quickly that authority can disappear.
That makes identity less of a supporting security function and increasingly the control plane for trust in the agentic enterprise.