Agentic AI: Identity Sprawl Threatens Security and Governance

What happened

The proliferation of agentic AI systems is poised to significantly exacerbate existing identity management challenges within organisations. Experts warn that these autonomous AI agents, designed to perform tasks independently, will rapidly expand the digital identities requiring oversight, potentially by a factor of one hundred. This anticipated surge in machine identities presents a substantial risk to cybersecurity frameworks and operational integrity, as current identity governance models are not equipped to manage such a scale. This development means that enterprises will face an unprecedented "identity sprawl," where numerous AI agents operate with varying levels of access and permissions across diverse systems. The complexity of managing these new identities, ensuring their security, and auditing their actions will introduce significant vulnerabilities if not addressed proactively. The issue extends beyond traditional user identity management, demanding new strategies to authenticate, authorise, and monitor these autonomous entities effectively.

Why it matters

For business leaders, AI practitioners, and policymakers, the impending identity sprawl driven by agentic AI is a critical governance and ethics concern. Unmanaged machine identities create vast attack surfaces, increasing the risk of data breaches, unauthorised access, and system manipulation. From an ethical standpoint, the lack of clear accountability for autonomous agents' actions, especially when their identities are poorly managed, poses challenges for auditing and establishing responsibility in case of errors or misuse. Strategically, organisations adopting agentic AI without robust identity governance will encounter significant operational friction and regulatory compliance hurdles. Establishing clear frameworks for AI agent identity lifecycle management—from provisioning to de-provisioning—is essential for maintaining trust, ensuring transparency, and adhering to emerging AI regulations. Failure to address this could undermine the very benefits that agentic AI promises, turning innovation into a source of systemic risk.

The Institute take

The focus on agentic AI's potential to amplify identity sprawl highlights a deeper, often overlooked, aspect of AI governance: the foundational infrastructure required for secure and ethical deployment. While the allure of autonomous agents is strong, the underlying identity and access management (IAM) implications are frequently underestimated in initial deployment plans.

Organisations are rushing to embrace agentic AI for efficiency gains, but many are neglecting the fundamental security and governance implications of machine identities. A responsible AI leader must recognise that effective AI governance begins with robust identity management for every agent, ensuring traceability, accountability, and the ability to revoke access instantly. Without this proactive approach, the promise of agentic AI could quickly turn into an unmanageable security and ethical quagmire.