In conversations with CISOs over the last six months, I keep hearing the same question queued up for their identity vendors: We’re rolling out AI agents across the business. How do we govern them?
That question isn’t going away. Over two-thirds of executives expect AI agents to be taking independent action inside their organizations by 2027, according to IBM research, which also projects that fully autonomous robotic systems will be operational across industries by 2030. CISOs in regulated industries are right to be worried about how Identity and Access Management (IAM) can keep up.
Structural Reasons Existing IAM is the Wrong Direction
Existing IAM is limited by scale and velocity. A workforce IAM tenant manages thousands of human identities, making authentication decisions a few times per session. An agentic tenant manages tens of thousands of agent instances, making authorization decisions every few hundred milliseconds, continuously. Bolt-ons sharing the workforce IAM’s session engine will hit scale walls before they hit production volume.
Agentic AI requires a level of authorization granularity that existing IAM can’t handle. Humans authenticate once and act repeatedly within a session. Agents need authorization at the level of every individual tool-call, which is sensitive to the specific arguments passed and data returned, not just the resource accessed.
The workforce IAM question is: Can this user call this API? The agent’s question is: Can this agent move $50,000 to this specific recipient right now? Workforce IAM’s policy wasn’t built for that decision. Machine identity has service-to-service trust but no decision surface for “this user’s agent doing this specific action.”
Identity behavioral analytics has 15 years of maturity for human users, such as known location, device, and time-of-day patterns. None of it ports to agents. Baselining agents requires tool-call distributions, argument patterns, return-data shapes, and inter-agent collaboration graphs.
IBM notes that AI agents “request access, invoke tools, and assume roles dynamically, accumulating privileges that were never explicitly granted or approved.” This is a different signal and response surface, and the maturity curve is barely off the floor.
Workforce IAM’s human-in-the-loop primitive is the login challenge: synchronous, at the keyboard, and once per session. Agentic identity needs something different: an action pauses mid-execution, an approver receives a context-rich request through a channel already in use, and the approval becomes part of a tamper-proof audit trail capturing who approved what, when, and on what basis. Regulated buyers will not let an agent move money without that flow.
Some vendors will argue they’re already shipping agent features. They are, but features added to a platform designed for human-scale, session-based authorization aren’t the same as building for a new category. Bolted-on features inherit the platform’s underlying assumptions, and those assumptions are the problem.
Four Questions to Ask Your Current Vendor
The answers will tell you which category you’re actually evaluating.
- Can you show me a policy decision that depends on the dollar amount, the recipient, and the data the agent is about to access? Not just whether the agent has permission to call the API. Walk me through what the policy looks like and where the decision happens.
- If we deploy 10,000 agent instances on Monday and 12,000 on Tuesday, does your platform reflect the new population at the next access review or in real time?
- What does your behavioral baseline look like for a single agent instance after one week of production traffic, and what does it trigger when it drifts?
- When an agent attempts a high-stakes action, what happens between the agent’s request and the action being executed? Specifically: where does the approval surface live, how does the approver receive enough context to make a real decision, and what does the audit trail capture about who approved what, when, and on what basis? Which chain of authority was involved?
Forty-five percent of executives say the absence of visibility into AI agent decision-making is a significant barrier to implementation. That barrier is exactly what the fourth question above is designed to expose. Vendors who can’t answer it concretely are not building for the new category.
Why This Shift Matters
The agentic shift changes how every system in the enterprise gets reached. An agent doesn’t sign in once a day; it acts thousands of times per hour across systems that were never designed to be touched at that velocity. A million agents at a hundred enterprises connected through shared APIs and federated trust become a single attack surface.
Agents will discover and amplify every shortcoming in existing identity platforms that humans never had the volume, speed, or coordinated behavior to expose. These include overly broad permissions latent since 2018, service-to-service trust assumptions that worked fine when nothing was probing them, and policy gaps no one noticed because no human ever moved fast enough to hit them. Agents will find all of it in weeks, not years, and across every interconnected system simultaneously.
The 2026 Allianz Risk Barometer ranks cyber incidents as the top global business risk for the fifth consecutive year, followed by “the closely linked peril of artificial intelligence.” That pairing isn’t a coincidence. It’s the same risk surface, expanded by orders of magnitude.
This is not a tremor. This is the tectonic shift the previous two only hinted at, and it will be felt worldwide, in every regulated industry, on a timeline measured in quarters and not decades. The CISOs who recognize this now and build IAM around the realities of the agentic AI era will protect their organizations from a category of threat the existing platforms were never designed to address. The ones that wait will be the cautionary tale.
The pattern has played out twice. The third one isn’t another lap. It’s a different track entirely.
