Ping YOUniverse: How to classify and manage AI agents

There are four different types of AI agents at work in modern enterprises, and each must be managed differently, several Ping Identity executives said at the company's Ping YOUniverse conference in Austin, Texas last week (Sept. 1-2).

"AI is attacking identity," said Ping VP of Consumer Segment Strategy Darryl Jones during a breakout session. "It's not creating a new security problem, but it's making the identity problem bigger."

Jones separated the agent types into two groups: personal agents that exist on endpoints like PCs and smartphones, and enterprise agents that exist in the cloud.

Each group itself has two types of agents. Within the personal-agent category, there are "employee agents" that help with personal productivity. They are accessed either through web browsers or mobile apps, like ChatGPT, or are running directly on devices, like Claude Code.

However, some of these can also act as "partner agents" and perform actions for their human users in the users' online accounts. In these cases, the human users let the agents "borrow" user credentials to the accounts so that they can send and reply to email messages, make travel arrangements, check bank accounts, and schedule meetings.

Employee agents do not have, and don't require, identities of their own. Humans access them by logging into OpenAI or Anthropic accounts, for instance, or lend the "agents" their own identities to act on their behalf.

Enterprise agents are different. Because they are not directly tied to a specific human user and act largely on their own, they do require their own identities.

One type is what Ping calls a "workload agent": It acts almost like a human employee, performing tasks in self-hosted or third-party cloud platforms managed by the enterprise itself. In general, these workload agents are also built by and directly managed by the enterprises using them.

The other kind of enterprise agent is described as a "SaaS-embedded agent," such as the Salesforce-created agents that run inside Salesforce instances. This is the type that an enterprise has the least control over.

The risks are high

"AI is moving from being a tool for workers to being the workers themselves," said Ping VP of Workforce Segment Strategy Gaurav Sharma during another breakout session. "And the risks are high."

But "not all agents are created equal," Sharma added.

Employee agents are not that risky, he said. Digital assistant agents — the partner agents — are riskier because they talk to more than one user, such as when scheduling meetings.

Single-domain autonomous agents —workload agents — are riskier still because they operate across a domain.

The riskiest, and the most useful to the enterprise, are the multi-domain autonomous agents, such as the SaaS-embedded ones, that execute workflows across the organization.

"Can we have this massive explosion of digital workers and still manage the risks?" asked Sharma.

After all, he said, agents acting without human input, such as the two types of enterprise agents, break the current trust model.

"They're probabilistic, goal-oriented, and emergent," Sharma added. "We'll start seeing things we haven't seen before."

Even worse, he said, many enterprises running AI agents put the agents in what he called "YOLO mode" for the sake of accelerated productivity, tweaking the settings so that the option "--dangerously-skip-permissions" is enabled and many guardrails are removed.

The road to effective AI management

Because AI agents are a new class of identity, and not NHIs, Sharma said, they need to be governed in new ways.

"LLMs suggest, but AI agents act," he clarified. "Every agent needs an owner, needs guardrails, and needs an audit trail. Every action needs to be authentication and authorized. Every surface needs to be visible."

One question must consistently be asked, Sharma added: "Is this agent, at this moment, authorized to perform this action?"

To achieve the degree of control necessary, Sharma and other Ping executives at the conference said, identity-management platforms must implement zero-trust policies, including just-in-time access and the principle of least privilege.

"We need to move away from shared persistent credentials and toward ephemeral just-in-time credentials tightly scoped to specific tasks," said Sharma.

Human ownership, or in a lesser form, custodianship, must be assigned to every AI agent, and the agentic runtime must be secured.

Discovery of AI agents across an enterprise, whether on endpoints, in cloud instances or in SaaS apps, is absolutely necessary.

Citing the "shadow AI" agents often downloaded and installed by users, Sharma said, "We should have the ability to discover them all."

Or, as said in a different presentation by Ping Senior Director of Workforce Strategy Stuart Proffitt, "once you discover, then you can control."