Enterprise agents are crossing an important boundary. They are moving from generating information to using tools: reading customer records, updating tickets, preparing transactions and coordinating other systems. At that point, model safety is only one part of the problem. The agent has become an actor inside the organisation's security architecture.
It needs an identity of its own.
Shared credentials erase accountability
Many early integrations run an agent under a developer's token, a broad service account or the credentials of the human who initiated the task. This is convenient, but it makes several questions difficult to answer. Was an action performed by the person or the agent? Which policy authorised it? Can the organisation revoke the agent without disrupting the user? Did the agent delegate work to another component?
NIST's 2026 work on software and AI agent identity and authorisation identifies identification, authorisation, auditing and non-repudiation as central design issues. Its later analysis of agentic identity argues that agents should be treated as first-class identities rather than invisible extensions of human accounts.
The implication is practical: every production agent should be independently discoverable, governable and revocable.
Separate identity from delegated authority
Knowing which agent is acting does not answer what it may do. Authority should be explicitly delegated for a purpose, within a scope and for a limited period.
An agent preparing a supplier review might receive read access to approved contracts and permission to create a draft assessment. That does not imply permission to approve the supplier, alter payment details or retrieve unrelated employee records.
The delegation should carry context: the initiating user, the task, the allowed tools, resource limits and any conditions that require human intervention. Short-lived credentials reduce the risk that authority survives beyond the work that justified it.
This design also supports chains of agents. If a coordinating agent asks a specialist agent to inspect a document, the second agent should receive only the authority needed for that subtask. Delegation must narrow or preserve scope, never silently expand it.
Put policy at the action boundary
Natural-language instructions are not a security control. An agent may misunderstand a prompt, encounter hostile content or select an unexpected tool path. Permission checks must therefore be enforced outside the model at the moment an action is attempted.
That boundary can assess the agent's identity, delegated purpose, requested operation, data classification and current environment state. High-impact actions can require a separate approval or a two-stage prepare-and-commit flow.
The OWASP Top 10 for Agentic Applications provides a useful industry framework for risks introduced when models plan and act through tools. It is guidance rather than a standard, but it reinforces the need to design controls around the whole agent system rather than the model alone.
Approval cannot carry the whole burden
Human approval sounds like a universal safeguard. In practice, asking a person to authorise every small action creates noise and habituation. NIST warns that overly frequent human-in-the-loop prompts can produce consent fatigue, weakening the accountability they are meant to provide.
The better pattern is risk-based. Pre-authorise low-impact, reversible actions inside a clear task boundary. Group related operations into a comprehensible plan. Reserve fresh approval for consequential, unusual or irreversible steps. The approver should see the intent, affected resources and material evidence—not a cryptic permission string.
Give every action a receipt
An agent's identity should flow into an immutable activity record. A useful receipt includes who initiated the work, which agent acted, the authority it held, the sources and tools used, policy decisions, approvals and the final state.
This supports investigation and compliance, but it also improves the product. When an action fails, the system can distinguish a model error from an expired credential, a policy denial or a changed record.
Agent identity is not administrative overhead added after innovation. It is what allows autonomy to scale without losing control. If an organisation cannot identify an agent, constrain its authority and reconstruct its actions, that agent is not ready to participate in production work.