Identity Governance And The Challenge Of AI Agents Moving At Machine Speed

Praerit Garg, CEO, One Identity, trusted leader in identity security, helping enterprises protect and simplify access to digital identities.

​An employee might spend an afternoon retrieving customer records or checking account details. Meanwhile, an AI agent might tick off those tasks within seconds, then repeat them thousands of times without pausing. We’ve reached a golden age of automation, where AI can do more than just automate—it can make decisions and act upon them at speeds that even a whole team of humans could fail to match.

But there’s a catch. While every individual action performed by an AI agent may fall within defined permissions and parameters, all it takes is one excessive entitlement or poorly designed approval process for an AI to cause significant damage. And because AI makes automation much simpler to achieve, allowing employees to turn existing permissions into powerful automated workflows with a single prompt, it’s becoming much harder to govern. With McKinsey reporting that up to 40% of organizations are already scaling an agentic AI system in at least one business function, this is quickly becoming one of the year’s defining security issues.​

Much of the industry’s response has focused on building entirely new identity and governance architectures specifically for AI agents, but they actually already have the right tools at their disposal in the form of identity governance and administration (IGA) and privileged access management (PAM). The same questions that are asked of humans should be asked of machines: Whose authority is the agent exercising? What information can it access? Which actions can it take, and when should additional approval be required? Instead of rebuilding governance architectures from the ground up, businesses simply need to refocus the tools and learnings already at their disposal, particularly zero-trust architectures.​