AI agents demand new identity architecture, CISOs warn

The proliferation of autonomous AI agents is creating a fundamental governance crisis as these dynamic, intent-driven entities operate beyond the constraints of traditional identity and access management systems designed for static human or machine accounts, according to Forbes.

AI agents, which can spin up quickly, chain actions across tools, and impersonate human intent at machine speed, are effectively becoming a new class of identity that requires continuous, contextual policy enforcement. Leading organizations are addressing this not by overhauling existing infrastructure but by implementing an orchestration layer that unifies existing IDPs, directories, and access policies into a centralized control plane. This orchestration abstracts complexity, allowing portable policies to be written once and enforced everywhere.

For real-time control, an AI identity gateway acts as an enforcement proxy, validating identity and intent on every call, using scoped tokens, and blocking anomalous behavior. This architecture ensures agents operate with least-privilege access, eliminates shadow agents through automated discovery, and provides complete audit trails, effectively making identity the trust fabric and governance layer for the entire agentic ecosystem without requiring a disruptive rebuild.