Why Identity Is Not Enough for AI Agents

Enterprise AI is moving beyond assistants that simply answer questions.

AI agents are increasingly being connected to business applications, APIs, collaboration platforms and operational systems. They may retrieve information, update records, initiate workflows or act on behalf of a person or organisation.

That makes identity increasingly important.

But identity alone is not enough.

Knowing which agent is acting does not necessarily tell an organisation whether the action it is about to take should be allowed.

Identity answers only part of the question

Traditional identity and access management has been built around an essential principle:

Who are you, and what are you allowed to access?

That remains critical for AI agents.

Organisations need to understand which agent is operating, who or what it represents, and which systems it has permission to use.

But as AI becomes more autonomous, a second set of questions becomes equally important:

• What is the agent attempting to do?

• Is that action appropriate in this context?

• Is the level of authority sufficient for this particular action?

• Does the action require confirmation or human oversight?

• Can the organisation later demonstrate what decision was made?

An authenticated agent can still attempt the wrong action.

An authorised agent can still operate in the wrong context.

And an agent with legitimate access can still be influenced by incorrect instructions, manipulated inputs or incomplete information.

Access is not the same as authority

Consider an AI agent that has legitimate access to a finance application.

Its identity may be valid.

Its credentials may be valid.

Its connection may be trusted.

But that does not automatically mean it should be able to change payment details, approve a high-value transaction or modify a sensitive account without additional controls.

The important distinction is between access and action authority.

Access answers:

Can this agent reach the system?

Action authority asks:

Should this agent be permitted to perform this particular action, right now?

As agentic systems become more capable, that distinction becomes increasingly important.

Authority can change with context

Human organisations already understand this concept.

A person may be authorised to perform routine work but require additional approval for an unusual transaction, sensitive change or high-impact decision.

AI agents need similar governance principles.

The appropriate level of control may depend on factors such as the action being attempted, the business process involved, the sensitivity of the environment or whether additional human oversight is required.

The objective is not to prevent AI autonomy.

It is to make autonomy governable.

From agent identity to agent governance

Agent identity therefore needs to sit within a broader control model.

Organisations need to be able to establish identity and permissions, while also placing controls around consequential actions.

That is where the Human Action Security Broker concept becomes relevant.

A Human Action Security Broker provides a control point around important actions taken by humans and AI systems.

For an AI agent, that means identity can establish who or what the actor is, while an action-security layer can help determine whether the intended action should proceed.

The two approaches are complementary.

Identity establishes the actor.

Action security governs the moment of consequence.

Evidence matters too

There is another question enterprises will increasingly need to answer:

What did the agent do, and why was it permitted?

As AI systems take on more operational responsibility, organisations will need more than activity logs.

They will need evidence that important actions were subject to the appropriate controls and that decisions can be reviewed afterwards.

This is especially important when responsibility is shared between an employee, an AI assistant, an autonomous agent and an enterprise system.

Clear accountability becomes harder when the boundaries between those actors begin to blur.

The next security layer

Identity remains foundational.

Strong authentication, permissions and agent identity are necessary parts of enterprise AI security.

But they are the beginning of the control model, not the end.

As AI moves from generating information to taking real-world digital actions, organisations will increasingly need to govern not only:

Who is acting?

but also:

What are they about to do?

That is the transition from identity security to action security.

And it is likely to become one of the defining security challenges of the agentic enterprise.

Know the actor. Govern the action. Prove the outcome.