Rethinking Digital Identity in the Age of AI Agents

As enterprises increasingly adopt AI agents capable of acting independently, managing identities and access is becoming more complex. These agents can access data, use tools and take actions on behalf of an organisation. Therefore, enterprises must identify each agent, assign accountability and define its authority.

Managing these agents requires more than granting them access to systems. Enterprises need to establish distinct identities for agents, define the authority granted to them and maintain control over that authority throughout their lifecycle. This requires a structured approach to identity management, machine identity governance and cryptographic trust, supported by clear accountability and ongoing lifecycle management.

Establishing identity and accountability for AI agents
Every AI agent that can access data, use a tool or take an action should have its own verifiable identity. Enterprises must manage each identity throughout the agent’s lifecycle, from registration at deployment to regular permission reviews as its role changes and revocation when they retire the agent or no longer trust it. While shared accounts may be convenient, they make it harder to establish which agent performed an action and who is responsible for it.

Accountability must remain with the business team deploying the agent. Each agent should have a named owner responsible for its purpose and outcomes. Security and identity teams should define how the enterprise identifies and monitors agents, while owners should justify the permissions they need and approve changes to their roles. Enterprises must also be able to trace an agent’s actions and withdraw its authority quickly when necessary.

Improving visibility and governance across machine identities
One of the first challenges in managing machine identities is knowing what exists. Certificates, service accounts, API credentials and other machine identities can be created across different teams, clouds and applications, often without a complete inventory or consistent ownership. This makes it difficult to identify expiring certificates, find overprivileged services or respond when a credential is compromised.

AI agents add another layer of complexity because they may connect several systems and acquire new permissions as their work expands. Enterprises need to connect identity discovery with ownership, policy and ongoing lifecycle management.

Traditional identity and access management (IAM) remains essential for determining whether a known identity can access a system. Autonomous agents, however, introduce an additional requirement: enterprises must identify the agent taking action, establish who is accountable for it, define the authority granted to it and verify that the authority remains valid. Autonomous agents, however, introduce an additional requirement — enterprises must know which agent is acting, who is responsible for it, what authority has been delegated to it and whether that authority remains valid.

These requirements become more consequential when agents interact across applications and organisational boundaries. Cryptographically verifiable identities and narrowly defined permissions can extend existing access controls to these interactions, but they do not replace the need to monitor what agents actually do.

Establishing trust between machines
Machine-to-machine interactions present a different challenge from interactions between a human user and an application. A human may recognise an unfamiliar request and stop to ask questions, but machines interact continuously and at a scale where that cannot be the primary safeguard.

Each system must reliably verify the other’s identity and determine whether it can authorise the requested action.When an AI agent acts across systems, the receiving system must also know the scope and status of the agent’s authority. Trust must be verified as part of each interaction and reassessed promptly if a credential, permission or risk changes. Enterprises must therefore verify both an agent’s identity and the authority granted to it.

Strengthening cryptographic infrastructure for AI adoption
Digital certificates, cryptographic credentials and identity infrastructure are part of the foundation for AI adoption, rather than tools used only to secure websites. Certificates and cryptographic credentials help establish identities that other systems can verify.

However, issuing an identity is only the beginning. CIOs must also track where credentials are used, automate their renewal and replacement, protect the underlying keys, and revoke credentials or access when necessary. These disciplines become increasingly important as AI agents interact with applications, APIs and other agents at machine speed.

The eventual arrival of post-quantum computing also requires enterprises to assess their existing cryptographic infrastructure.Organisations do not need to discard their existing infrastructure. However, they must identify where quantum-vulnerable cryptography exists across their systems and products, including mechanisms that protect long-term data.

This includes the use of public-key cryptography for exchanging keys and verifying signatures. The priority is to identify these dependencies and develop a risk-based migration plan. Organisations should also assess whether they can replace cryptographic algorithms without rebuilding every application. Post-quantum readiness is a sustained transition. The ability to adapt cryptographic infrastructure matters as much as any single replacement algorithm.

Preparing for an increasingly autonomous digital enterprise
CIOs should begin by establishing visibility across machine identities, certificates, cryptographic dependencies and AI agents, assigning an owner to each. They should then identify where teams share credentials, grant excessive permissions or rely on manual processes to renew them. Before deploying agents in production, enterprises should assign each one a distinct identity, restrict its authority, record its actions and ensure they can revoke its access when necessary.

Organisations should also incorporate cryptographic agility into procurement and architecture decisions, enabling them to adopt new standards as requirements change.

As AI agents take on more responsibilities, enterprises must continue to verify their identities, define their authority and establish accountability for their actions. Distinct identities, clearly defined permissions and adaptable cryptographic infrastructure will remain central to maintaining that control.