AI Agents Change the Identity Security Question
AI agents are starting to look less like tools and more like coworkers with access.
They can write code, query data, update files, summarize customer records, trigger workflows, and keep working after the person who launched them has moved on. That is useful. It also creates a question security teams need to answer quickly: what can the agent actually reach?
This article is based on Segura®’s webinar, “Identity Security Beyond PAM: From Discovery to AI Agents.” Joseph Carson, Evandro Gonçalves, and Bill Willis from IDMWORKS discussed why identity security now has to cover human users, service accounts, machine identities, workloads, and AI agents.
The core question has changed:
“Who has access to what” is now “who and what has access to what.”
That “what” includes AI agents, automations, scripts, workloads, service accounts, and short-lived processes that may appear, act, and disappear before a quarterly review ever sees them.
Key Highlights
- AI agents often use access that already exists. A finance user, developer, or data analyst can launch agents that work across systems around the clock.
- Unused access becomes active again. Unused permissions, broad service accounts, and leftover role access give agents more room to act.
- Discovery has to watch behavior, not just accounts. Teams need to know what created access, what used it, and whether that activity belongs.
- Human review still matters for high-risk work. Payments, customer data, health data, production changes, and regulated workflows need approval boundaries.
- Identity security beyond PAM connects discovery, PAM, IGA, SOC, DevSecOps, and audit evidence.
AI Agents Can Turn One User’s Access Into Many Active Identities
AI agents change identity security because they act.
They take a task, use tools, call systems, and keep working. Bill Willis described the business driver clearly in the webinar: companies want to do more with less, and AI lets one person create a team of digital personas that can work 24 hours a day, 7 days a week. That team needs access.
If a user can reach customer records, source code, cloud systems, payment approvals, or production tools, an agent may be able to work inside those same workflows.
Bill put the risk in business terms:
“The person that can write a million dollar check, the person that transfers the money for payroll, the person that does the benefits and the insurance coverages. Those are the people that if they spawn artificial intelligence with their privileges… that’s exactly where the attack surface is at its highest risk.”
That’s where security teams should start.
Find the people whose access can move money, change customer records, touch regulated data, or affect production. Then find which agents, automations, and delegated workflows can use that access.
Stolen Credentials Show Why AI Agents Need Stronger Identity Controls
The Snowflake customer data theft campaign shows why valid access deserves more scrutiny.
Mandiant reported that UNC5537 used stolen customer credentials to access Snowflake customer environments. Mandiant and Snowflake notified about 165 potentially exposed organizations. Mandiant said the campaign underscored the need for credential monitoring, MFA enforcement, trusted-location controls for critical systems, and alerts on abnormal access attempts.
The AI connection is access. Agents, like attackers with valid credentials, can operate inside approved systems when identity controls are weak. IBM’s 2025 Cost of a Data Breach Report found that 13% of organizations reported breaches involving AI models or applications, and 97% of those organizations lacked proper AI access controls.
AI adoption is moving faster than AI access governance.
Privilege Sprawl Gives AI Agents More Room to Act
Privilege sprawl has always been a problem.
People change roles. Old access stays. Service accounts keep broad permissions. Emergency access becomes routine access. Application privileges hide inside business systems.
AI agents can make that access active again.
Joseph Carson explained the risk in the webinar: if organizations have not cleaned up privileges and moved toward least privilege, AI can spawn multiple identities or delegated identities based on those existing privileges. One accountant’s access can become dozens of identities working around the clock.
Bill used a line security teams will remember:
“AI will find all the cracks in your current environment and just blow it apart.”
The work starts with the basics:
- Remove access people no longer need
- Reduce standing privilege
- Separate duties in business applications
- Vault privileged credentials
- Move privileged access toward just-in-time access
- Review service accounts and machine identities
- Watch for AI agents using human access
These controls were already important. AI makes them harder to delay.
AI Agent Guardrails Need Access Controls Behind Them
Evandro Gonçalves shared a simple example from testing an AI agent on his workstation.
He asked the agent to modify and delete files. It completed the action without asking for machine-level privilege prompts.
That kind of speed can be useful in the right workflow. It also becomes risky when an agent can interact with Salesforce, cloud consoles, ticketing systems, repositories, internal databases, or production systems.
Bill gave a short set of operating rules during the webinar:
“Don’t drift. Don’t assume. Dig deep. Do not deploy. Log everything.”
AI Agent Operating Rules
Prompt guardrails help. Access control, approval workflows, monitoring, and audit records are what make them enforceable.
Identity Discovery Needs Real-Time Identity Signals
Discovery can’t stop at known users and accounts. Identity security now needs to see humans, service accounts, machine identities, workloads, AI agents, scripts, and automations.
Bill said the industry needs to think about discovery at the event and signal layer. Teams need to know who or what spawned an event, where it appeared, whether other systems recognize it, and what action should happen next.
The useful questions are simple:
- What identity or agent created this activity?
- What system did it access?
- What data did it touch?
- Was the access approved?
- Does PAM, IGA, access management, SOC, or DevSecOps recognize it?
- Can the team pause, quarantine, or remove it?
A one-time inventory can miss agents and workloads that appear, act, and disappear between review cycles.
Evandro said discovery should be real-time when possible. If that isn’t feasible, teams should run it as constantly as they can, at least daily and ideally hourly.
Static Access Reviews Miss Short-Lived AI Agent Activity
Many identity programs still depend on periodic reviews. A user account exists. A role exists. An entitlement exists. A review checks whether the access still makes sense.
AI agents and short-lived workloads can move faster than that process.
Joseph talked about identities becoming less persistent. Some workloads appear, perform a task, and disappear. Bill said some of the most important activity may happen in “3 to 5 milliseconds.”
Why Access Reviews Need Identity Signals
Access reviews help teams confirm whether access still makes sense. Identity signals help teams see fast-moving activity before the next review cycle. For AI agents and short-lived workloads, teams need both.
Human Review Still Matters for Regulated AI Workflows
Some AI actions need a person in the decision path.
Evandro said human review will remain important because AI systems can return different results from the same prompt. Bill added that regulated areas such as GDPR, personal information, personal health information, PCI, financial transactions, and consumer-facing processes need a human decision path.
A simple starting point:
AI Agent Actions by Control Level
The business does not need one rule for every AI agent. It needs clear boundaries for what agents can do on their own, what requires approval, and what should be blocked.
What to Audit First for AI Agents Already in Use
Evandro recommended auditing before strict blocking when AI agents are already in use. Abrupt controls can disrupt work if security teams do not understand how people are using agents today.
Start with the agents most likely to create business impact.
First AI Agent Triage Checklist
This gives security teams a fast baseline: which agents exist, who owns them, what they can reach, and which ones could affect the business.
Identity Security Beyond PAM Connects PAM, IGA, SOC, and DevSecOps
AI agent risk does not sit inside one tool.
PAM controls privileged access. IGA handles ownership and lifecycle. Access management controls authentication. SOC teams see behavior. DevSecOps sees workloads, pipelines, and production changes. AI agents can touch all of those areas.
A modern identity security program needs signals across:
- PAM: privileged access, vaulting, session control, just-in-time access
- IGA: joiner, mover, leaver workflows, access reviews, ownership
- Access Management: authentication, SSO, MFA, conditional access
- SOC: alerts, behavior, identity events, incident response
- DevSecOps: pipelines, workloads, secrets, production promotion
- Audit and compliance: evidence, logs, approvals, policy records
When an AI agent acts, teams should be able to answer:
- Who launched it?
- What did it access?
- Was that access approved?
- What changed?
- Should the behavior continue?
That is identity security beyond PAM.
Checklist: How to Secure AI Agents and Machine Identities
Use this checklist to review your current program:
- Can you keep humans in the loop for regulated or high-risk decisions?
- Can SOC, IGA, PAM, access management, and DevSecOps share signals?
- Can you quarantine or disable agents that act outside policy?
- Can you log agent actions in a way auditors can review?
- Can you vault credentials used by agents and automations?
- Can you move privileged access to just-in-time access?
- Can you enforce least privilege before an agent acts?
- Can you see what data an agent can reach?
- Can you identify who owns each AI agent or automation?
- Can you see which identities are active right now?
- Can you discover human, machine, service account, workload, and AI agent identities?
If several answers are “not yet,” AI agents may already be using access your team has not reviewed.
Identity Security Beyond PAM Requires Real-Time Discovery and Control
AI agents are changing the identity question.
Security teams still need to know who has access to what. They also need to know which agents, service accounts, workloads, scripts, and automations are using access across the environment.
That requires discovery, identity signals, least privilege, just-in-time access, ownership, auditability, and response.
Teams that handle this well can see what is acting, understand what access it has, reduce unnecessary privilege, and keep human review where the risk demands it.
Watch the Webinar: Pressure-Test Your AI Agent Identity Strategy
You’ve read the main takeaways. Watch the webinar for the harder part: the discussion behind the controls.
Joseph Carson, Evandro Gonçalves, and Bill Willis dig into the decisions security teams need to make now, including who owns AI agents, when humans need to stay in the loop, what to audit first, and how identity discovery changes when access can appear and disappear in milliseconds.
Control Access Before AI Agents Use It
AI agents usually act through the access available to them, and that access may already be broader than it should be. That’s why identity security has to start with discovery, ownership, and control before agents become another unmanaged layer of access.
Segura® helps organizations discover, manage, and control privileged access across human identities, machine identities, service accounts, and emerging AI agent workflows.
With Segura®, teams can strengthen identity security with discovery, visibility, access governance, credential protection, session control, just-in-time access, and audit-ready evidence.
Give AI less unnecessary access to use. Give security teams a clearer view of what is acting. Give auditors a record that shows what happened.
Identity Security Beyond PAM FAQs
What does identity security beyond PAM mean?
Identity security beyond PAM means controlling privileged access across human users, service accounts, machine identities, workloads, automations, and AI agents.
Why do AI agents change identity security?
AI agents can use tools, access systems, and take actions through inherited or delegated access. That means teams need to know what agents can reach, who owns them, and what they are allowed to do.
What should teams audit first for AI agents?
Start by identifying which AI agents exist, who owns them, what systems they connect to, what access they inherit, what data they can reach, and whether they can be paused or removed.
How often should identity discovery run?
The webinar recommends real-time discovery where possible. If real-time is not feasible, discovery should run as often as the environment allows, ideally hourly or at least daily.
