COMMENTARY: For years, enterprise identity security has revolved around two fundamental questions: Who is this person? And what are they allowed to do?
AI agents complicate both because unlike other bots, they’re a proxy for a person.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
Agentic commerce offers an instructive use case to explore what this means in practice. Retailers, banks, and payment processors are already letting AI agents transact for consumers.
That’s required fraud teams to implement new ways of determining if agents are legitimate, whether they have permission to act and whether they are doing what the customer intended.
As agents spread across the enterprise, security teams are now confronting these same issues: valid credentials and authorized access and seemingly “normal” behavior doesn't always mean actions are legitimate. As security teams tackle these challenges, fraud teams can help them navigate how behavior, context, and intent fit alongside traditional identity controls.
There’s no getting around the reality that agents need privileges. They need to have and use credentials, call APIs, access sensitive data and initiate actions across applications. They also need some latitude to decide how to accomplish a task without a human directing every step.
That presents a problem for identity and access management systems built to authenticate users and authorize access. An agent may have been properly authenticated and perform an action it has permission to perform. That doesn't necessarily mean it’s a legitimate action or something the user intended.
NIST has been examining how the industry can apply existing identity and authorization standards to AI agents, including how organizations can identify agents, control their access and audit their actions. More recently, NIST warned that early agent deployments are repeating the old security pattern of prioritizing new capabilities and immediate business value over security.
For CISOs, identifying and authenticating agents represents only part of the problem. The harder question: What happens after authentication?
Insider-threat programs don't assume there’s safe activity simply because someone uses legitimate credentials. Fraud teams make similar distinctions. A customer can successfully authenticate into a bank account and still initiate a transaction that warrants scrutiny because the behavior or context looks wrong.
Let’s say an employee authorizes an AI agent to manage email, documents, and calendar appointments. The agent may need access to all three applications. But that doesn't mean it should have the ability to forward a confidential document outside the organization, download thousands of files, or expose internal information while completing a task. Security teams will need a way to determine if the activity stays consistent with what the user and organization intended when those permissions were granted.
Delegated authority needs limits
The issue becomes more complicated when agents interact with other agents and systems. A human can authorize an agent, which calls another service, which invokes another tool or agent. With each handoff, it becomes harder to determine where the authority originated and whether subsequent actions remain within its intended scope.
We need to make delegated authority specific and constrained. An agent authorized to schedule a meeting shouldn't automatically inherit broad access to every system the employee can reach. Limit permissions by task, resource and duration. OWASP's guidance for AI agent security similarly recommends least privilege, per-tool permission scopes and explicit authorization for sensitive operations.
Organizations also need to preserve the chain of delegation so security teams can determine who initiated an activity, what authority was delegated, and how it was used.
Identity needs context
Enterprises already have environments filled with employees, bots, APIs, service accounts and automated processes. AI agents add another category, but knowing that traffic came from an agent doesn't tell a security team whether the team should trust it.
A legitimate employee can use an unauthorized agent. An approved agent can also get compromised or manipulated. A malicious actor can use automation that resembles legitimate agent activity. And an authorized agent can take an unexpected action while pursuing a legitimate task.
Fraud teams offer a useful model. They don't make decisions based on identity alone because Zelle scams and other forms of Authorized Push Payment (APP) fraud rely on the use of social engineering to trick authenticated users into making authorized payments. They consider behavior and context: what’s happening, what resources are involved, whether the activity fits expected patterns, and whether a sequence of permissible actions adds up to something suspicious. Identity security will increasingly need to do the same.
Organizations can’t rely on agent identity standards alone. They can start by finding out where agents are operating and what systems, credentials, and data they can access.
Logging should capture enough context to reconstruct what an agent did, including who or what delegated its authority. High-impact actions may require additional controls or human approval when activity falls outside the agent's expected scope.
None of this makes traditional identity controls obsolete. Authentication, authorization and least privilege become more important when software can act autonomously. But they are no longer the whole job.
In an agentic enterprise, identity still tells us who’s at the door. But increasingly, security also needs to understand – and monitor – their intent.
Caleb Moore, chief technology officer, Darwinium
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
