AI Agents Are the New Privileged Identities: Is Your IAM Strategy Ready?
For years, organizations have focused on securing human users, service accounts, applications and machines. Now, a new category of identity is entering the enterprise: the AI agent. Unlike traditional AI assistants that mainly generate answers, agentic AI systems can reason, make decisions, access applications, retrieve sensitive data, call APIs and execute actions with limited human involvement. An AI agent may soon be able to: This capability can deliver significant productivity improvements. It can also create a new class of highly privileged, autonomous identities. The question is no longer only, “Is the AI model secure?” Organizations must also ask:Who is the agent, what is it permitted to access, who is responsible for it and how can its authority be withdrawn? From Model Risk to Action Risk Traditional generative AI security often focuses on risks such as prompt injection, sensitive-information disclosure, insecure output handling and data poisoning. Agentic AI expands the problem. An agent does not simply produce content. It can translate that content into action by using tools, credentials, APIs and enterprise applications. A manipulated chatbot may provide an incorrect response. A manipulated AI agent could change a configuration, disclose sensitive information, delete data or execute an unauthorized transaction. This is the difference between model risk and action risk. The greater an agent’s autonomy, connectivity and access privileges, the greater its potential blast radius. Recognizing this shift, NIST launched its AI Agent Standards Initiative in 2026 and began examining how established identity and authorization practices can be applied to software and AI agents. OWASP’s Top 10 for Agentic Applications also highlights risks such as agent goal hijacking, tool misuse, identity and privilege abuse, memory poisoning, insecure agent communication and rogue-agent behaviour.Agent security is quickly becoming an identity-security challenge. Why Every AI Agent Needs Its Own Identity An agent should never operate as an invisible extension of a human account or through a shared, permanently privileged credential. Every production AI agent should have a unique and verifiable identity. That identity should establish: Separate identities make it possible to enforce least privilege, monitor behaviour, investigate incidents and revoke access without affecting unrelated users or agents. If multiple agents share the same identity, security teams may be unable to determine which agent performed an action or whether it was initiated by a user, an agent or a compromised integration.Accountability begins with identity. Five Identity Risks Created by AI Agents 1. Excessive privileges Agents are often given broad access because developers want them to complete workflows without interruptions. An agent that only needs to read support tickets should not be able to delete them. An agent that recommends cloud changes should not automatically have permission to deploy those changes. Convenience must not replace least privilege. 2. Agent sprawl Business teams may create AI agents faster than security and IT teams can discover or govern them. Without a central inventory, organizations can accumulate unknown, duplicated or abandoned agents connected to sensitive systems. This resembles service-account sprawl, but with an added layer of autonomy. 3. Shared or inherited credentials An agent may inherit the permissions of its creator or use a shared API key. If the agent is compromised, an attacker may gain the same access. Long-lived credentials also make revocation and attribution more difficult. 4. Goal hijacking and tool misuse Malicious instructions hidden inside emails, documents, websites or external data can influence an agent’s behaviour. If the agent can access powerful tools, manipulated instructions may lead to unauthorized data retrieval, message sending, code execution or configuration changes. 5. Incomplete audit trails Traditional logs may record that an API was called without explaining which agent initiated it, which user request triggered the action or what information influenced the decision. Security teams need visibility across the complete chain: Human request → Agent decision → Tool invocation → System action → Business outcomeWithout this context, investigation and accountability become extremely difficult. Building an Identity-First Security Model for AI Agents Organizations do not need to abandon their existing security foundations. They need to extend them to autonomous systems. A practical identity-first approach should include the following controls. Discover and classify every agent Maintain a central inventory of production and experimental agents. Record the agent’s owner, purpose, environment, connected systems, data access, model, tools and operational risk. Assign a unique identity Every agent should have its own managed identity rather than using a shared account or impersonating its creator. The organization must be able to distinguish between: Enforce least-privilege access Access should be limited by task, resource, environment, time and risk. An agent should receive only the permissions required for its approved purpose. Privileged access should be temporary wherever possible. Introduce approval gates High-impact activities should require explicit human approval. These may include: Autonomy should be proportional to risk. Protect credentials and tokens API keys, secrets and access tokens should be stored in approved secrets-management systems, rotated regularly and prevented from appearing in prompts, memory or logs. Short-lived credentials are preferable to permanent access. Monitor agent behaviour Security teams should establish normal behaviour for each agent and detect unusual actions, access patterns, tool usage or data movement. Logs should capture the agent identity, initiating user, requested objective, tools invoked, resources accessed and final action. Govern the complete lifecycle Agents should be provisioned, reviewed and decommissioned through a controlled lifecycle. When an owner leaves, a project ends or an agent is no longer required, its credentials and access must be revoked immediately. Test before granting autonomy Organizations should evaluate agents for prompt injection, excessive agency, tool misuse, data leakage, privilege escalation and unexpected behaviour before production deployment. Security testing must cover the complete agent workflow—not only the underlying model. Questions Leaders Should Ask Today Before deploying an AI agent, security and business leaders should be able to answer: If these questions cannot be answered, the agent is not ready for unrestricted enterprise access. The Next IAM Challenge Has Already Arrived AI agents are becoming part of the enterprise workforce, but they cannot be governed exactly like employees or treated merely as
5 AI Governance Frameworks, Laws and Standards Every AIGP Candidate Should Know in 2026
Artificial intelligence adoption is accelerating faster than many organisations can establish effective governance. Bain reported in 2025 that 95% of surveyed US companies were using generative AI. The research also found that the average number of production use cases had doubled between October 2023 and December 2024. This growth creates enormous opportunities, but it also introduces risks involving privacy, cybersecurity, discrimination, transparency, accountability, intellectual property and regulatory compliance. Organisations therefore need more than an AI policy. They need structured ways to identify risks, assign accountability, evaluate impacts and monitor AI systems throughout their lifecycle. For professionals preparing for the IAPP Artificial Intelligence Governance Professional certification, understanding the major AI governance instruments is essential. However, candidates must also recognise an important distinction: A framework, regulation, standard, policy directive and code of conduct are not the same thing.This guide examines five important AI governance instruments and explains how each should be understood. 1. NIST Artificial Intelligence Risk Management Framework The NIST Artificial Intelligence Risk Management Framework, commonly called the NIST AI RMF, was released in January 2023 by the US National Institute of Standards and Technology. It is a voluntary and industry-agnostic framework designed to help organisations manage risks associated with the design, development, deployment and use of AI systems. Rather than providing a rigid compliance checklist, the framework helps organisations establish repeatable processes for trustworthy AI. The NIST AI RMF is structured around four functions: Govern Establish policies, accountability, organisational roles, risk tolerances and oversight mechanisms for AI. Map Understand the purpose, context, stakeholders, potential impacts and operating environment of an AI system. Measure Assess, analyse and track AI risks using appropriate qualitative and quantitative methods. Manage Prioritise identified risks, implement controls, monitor responses and determine whether risks should be accepted, mitigated, transferred or avoided. AIGP Accuracy Note The four official functions are: Govern → Map → Measure → Manage “Monitor” is not a separate NIST AI RMF function. Monitoring activities may support the framework, but the fourth function is officially called Manage. Why it matters The NIST AI RMF helps organisations translate broad responsible-AI principles into practical governance activities. It can be adapted across industries and used alongside privacy, cybersecurity, enterprise-risk and compliance programmes. For AIGP candidates, the important point is to understand both the four functions and the iterative relationship between them. 2. European Union Artificial Intelligence Act The EU AI Act is not a voluntary framework. It is a legally binding regulation governing the development, deployment and use of AI systems within its scope. The Act entered into force on 1 August 2024 and follows a phased implementation timeline. Prohibited AI practices and AI-literacy requirements began applying in February 2025. Obligations concerning general-purpose AI models began applying in August 2025. Most remaining provisions are scheduled to become applicable from 2 August 2026, while certain requirements for high-risk AI systems connected with regulated products follow a later timeline. The Act applies a risk-based regulatory model. Prohibited AI practices Certain practices presenting unacceptable risks to fundamental rights are prohibited. These include specific forms of social scoring, manipulative AI, biometric categorisation and other practices defined by the regulation. The prohibitions are specific. It would be inaccurate to assume that every use of surveillance, biometrics or automated monitoring is automatically banned. High-risk AI systems AI used in sensitive areas such as employment, education, essential services, law enforcement and certain regulated products may be classified as high risk. Depending on the system and the organisation’s role, requirements may include: Transparency obligations Certain AI systems must disclose that users are interacting with AI. Additional transparency requirements may apply to synthetic content, deepfakes and general-purpose AI models. Minimal or no-risk systems Many ordinary AI applications remain largely unaffected, although organisations may still voluntarily adopt codes of conduct and responsible-AI practices. AIGP Accuracy Note The EU AI Act was not adopted in late 2023 and is no longer merely “expected to take effect.” It entered into force in August 2024, and several of its provisions are already applicable. Why it matters The EU AI Act moves AI governance from voluntary principles to enforceable responsibilities. Its influence is also likely to extend beyond Europe because organisations offering AI systems or services in the EU may fall within its scope. AIGP candidates should understand the difference between prohibited practices, high-risk requirements, transparency obligations and general-purpose AI responsibilities. 3. ISO/IEC 42001 and ISO/IEC 23894 ISO and the International Electrotechnical Commission have developed complementary standards for AI governance and risk management. Although they are frequently discussed together, ISO/IEC 42001 and ISO/IEC 23894 serve different purposes. ISO/IEC 42001:2023 ISO/IEC 42001 establishes requirements for an Artificial Intelligence Management System. It helps an organisation build an enterprise-wide system of policies, roles, objectives, processes and controls for the responsible development or use of AI. The standard follows the Plan-Do-Check-Act model commonly used across ISO management-system standards. It addresses areas such as: Because ISO/IEC 42001 is a requirements-based management-system standard, an organisation may pursue certification through an independent certification body. ISO/IEC 23894:2023 ISO/IEC 23894 provides guidance on managing risks specifically associated with AI. It helps organisations integrate AI-related risks into their existing risk-management activities and considers risks affecting organisations, individuals, groups and society. The standard can support AI risk identification, analysis, evaluation, treatment, communication and monitoring. AIGP Accuracy Note ISO/IEC 42001 is an AI management-system requirements standard against which an organisation may be certified. ISO/IEC 23894 is a risk-management guidance document. It is not a management-system certification standard. Why they matter Together, the two standards provide complementary value. ISO/IEC 42001 helps establish the organisational management system, while ISO/IEC 23894 provides deeper guidance for managing AI-specific risks within that system. For AIGP professionals, understanding this distinction is important when advising organisations about governance implementation and certification. 4. OECD Artificial Intelligence Principles The OECD AI Principles were originally adopted in 2019 and updated in May 2024 to address developments involving general-purpose and generative AI. They were the first intergovernmental standard for trustworthy AI and have influenced national policies, international initiatives and other governance instruments. The principles
