IAM for AI agents: a practical enterprise framework

Identity and access management (IAM) for AI agents is the control architecture that governs software agents as they authenticate, invoke tools and act in enterprise systems with delegated authority. A guide published by The Hacker News on 28 September 2026 sets out what such a framework has to cover.

What counts as an agent identity

The guide treats every agent as a non-human identity with a human owner, a defined purpose, scoped authorization, an expiration and continuous monitoring. The hard part is architectural: IAM platforms describe intended access, while applications and infrastructure reveal what the agent actually executed. Between the two sits identity dark matter, the accounts that central identity data never reports.

Where conventional IAM falls short

Traditional programmes work at design time, with lifecycle management and joiner-mover-leaver workflows, and at runtime, with access checks at the application perimeter. Both describe access as configured, not as used. A person follows a predictable path, while an agent chains tasks and selects tools dynamically. The guide cites OWASP's excessive agency entry (LLM06).

Agent identities are usually created by infrastructure automation or application teams rather than HR-driven events, so they bypass the workflows that catch human access anomalies. Recurring failures include long-lived static secrets, delegation inherited from a service account and pilot access that outlives the pilot.

Identity, scope and evidence

On identity, the guide wants a distinct, attributable identity per agent, never a shared account, built on workload identity federation and short-lived, automatically rotated credentials. Where an agent acts for a user, OAuth 2.0 Token Exchange (RFC 8693) keeps its own identity separate from the authority it is lent. Scoping follows NIST SP 800-53 Rev. 5: least privilege (AC-6), separation of duties (AC-5) and human approval for high-consequence actions.

Auditability is the third leg. NIST's AI risk framework ties accountability to traceable behaviour, and SP 800-53 expects records that reconstruct a sequence of actions. Because valid-accounts abuse (T1078) produces legitimate-looking login records, monitoring must compare the intended task with actual execution.

Choosing and phasing a framework

Seven criteria are proposed: ownership, credentials, delegated authorization, discovery coverage, runtime telemetry, enforcement reach and audit evidence. Most enterprises should extend the IAM platform they already run; SailPoint and Saviynt cover design time, while buying matters for discovery and verification. Three maturity stages end in continuous observability, and the next problem is agents delegating authority to each other. The piece is a contributed article from partner Orchid Security.