DECISION BRIEF 28

AI Agent Identity Governance: Control Authority Before Autonomy

AI agent identity governance means every agent must have a distinct, verifiable identity; authority limited to a specific task; and an unbroken line of accountability to a human or institution. A CEO should not approve broader autonomy until the organization can identify the acting agent, prove who authorized it, enforce permissions outside the model, reconstruct its delegation chain, and revoke access immediately.

The leadership implication is simple: an agent is not merely software with a login. It is a non-human actor that can interpret intent, choose tools, create sub-agents, cross security boundaries, and act at machine speed.

Baca versi Indonesia

Executive deck

The conventional assumption is that existing employee credentials, service accounts, and role-based access controls can be extended to AI agents. That assumption becomes unsafe when an agent inherits a user's broad permissions, decomposes a task unpredictably, or delegates work across systems and providers.

AI changes the identity problem in six ways: agents can be ephemeral; authorization must follow a task rather than a job title; permissions can accumulate across chains; cross-domain systems may interpret scopes differently; model reasoning is probabilistic; and the accountable human can disappear from the execution record.

What can be automated includes identity issuance, task-bound tokens, policy checks, scope attenuation, credential expiry, behavioral monitoring, evidence capture, and revocation. What remains irreducible CEO judgment includes which actions may be delegated, which consequences require a human decision, how much authority any agent may hold, who remains accountable, and when autonomy must stop.

Evidence signal

The evidence supports a control-plane conclusion: identity and authorization must be evaluated at the moment of action, not inferred from the prompt or borrowed from the user's session.

Signal	Leadership implication	Scope and limitation
NIST received more than 600 responses to its 2026 concept paper and found near-unanimity that agents need distinct, verifiable non-human identities, although no single technical approach has consensus.	The problem is mature enough for executive action but not mature enough for a one-vendor answer. Design around durable principles and test interoperability.	NIST NCCoE summary, 29 September 2026. It summarizes public comments and planned demonstrations; it is not a final standard.
NIST's summary says task credentials should expire, narrow as authority moves down a delegation chain, and be revocable without disrupting unrelated workflows.	Long-lived user keys and inherited entitlements create an avoidable blast radius. Authority should be temporary, specific, and smaller at each hop.	NIST stakeholder consensus, not a mandated implementation profile.
OpenID Foundation's 12 October threat model identifies cross-boundary failures including false agent identity, mismatched trust assumptions, permission broadening, access that outlives the task, and reusable stolen credentials.	A valid token in one domain does not prove that another domain interprets identity, scope, or consent correctly. Translation is a security decision.	Protocol-agnostic threat model. It names threats and actions; it does not claim a complete solution.
OWASP's Agent Control Standard requires agents to be inspectable, traceable, instrumentable, and controllable at runtime. OWASP's Q3 synthesis found cases where reachability became effective authorization and excessive credentials expanded impact.	Prompt instructions are not an access-control boundary. Policy enforcement must sit outside the model and control actual tool, data, network, and credential use.	OWASP, 1 September and 8 October 2026. Incident mappings are analytical and several cases originated in evaluation environments.
The Expanded ASEAN Guide on AI Governance and Ethics supplements the region's 2024 guide with generative-AI considerations.	Southeast Asian companies should align agent identity controls with existing risk-based governance, accountability, privacy, security, and human-oversight obligations rather than wait for agent-specific law.	ASEAN, January 2025. Regional voluntary guidance; sector and country obligations still apply.

These signals do not prove that one identity protocol will prevail. They do show that agent authority cannot remain an implicit property of a user account, API key, prompt, or vendor platform.

The decision question

The decision is not “Can the agent authenticate?” It is “Can the enterprise prove which agent acted, for which task, under whose authority, with what exact permissions, and whether those permissions were valid at the moment of action?”

That distinction prevents six common failures:

User impersonation. The agent acts with the full authority of an employee account, making human and machine actions indistinguishable.
Ambient privilege. A long-lived service account grants access unrelated to the current task.
Delegation expansion. A sub-agent receives more authority than its parent or loses the original constraints.
Cross-boundary ambiguity. Two providers interpret the same role, scope, or consent differently.
Model-controlled authorization. The model decides whether its own proposed action is permitted.
Orphaned access. The task ends, but credentials, sessions, or background agents remain active.

The conventional assumption to challenge

The legacy pattern authorizes a person at login, assigns a role, and lets applications inherit that context. It assumes the actor is stable, the requested resource is known, and the authorization policy is deterministic.

An AI agent breaks all three assumptions. It may create a short-lived sub-agent, discover a new tool, reinterpret the goal, encounter untrusted content, or cross an organizational boundary after the initial login. Authorizing the user once does not authorize every action the agent later invents.

The operating model therefore needs two separate planes. The reasoning plane proposes what to do. A deterministic control plane decides whether the identified agent may do it now, records the decision, and can refuse or revoke the action.

Point of view

The recommended default is identity before access, authority before action, and evidence before scale. Every production agent should be treated as a governed non-human identity with a named sponsor and a lifecycle—not as a feature hidden inside an application.

The minimum viable identity record should include the agent's stable trust anchor; operating instance or run; model and software provenance; accountable human or institutional principal; approved task; tools and data domains; delegated scopes; parent-agent lineage; expiry; policy version; and revocation state. Not every field must travel in every token, but the control plane must be able to verify the record at runtime.

This does not require a new identity stack for every pilot. It requires extending existing identity and access management with task context, non-human identity inventory, delegation evidence, ephemeral credentials, and policy enforcement that the model cannot rewrite.

Thought process

The recommendation follows nine observations.

Authentication answers too little. It proves an identity claim, not whether the proposed action belongs to the authorized task.
A human session is too broad. Copying a user's permissions gives the agent unrelated access and obscures attribution.
Agents create agents. Delegation must preserve the original principal, intent, constraints, and decreasing scope across every hop.
Tasks end. Credentials should expire with the task, not remain available for the next prompt or background process.
Boundaries translate meaning. Cross-provider calls require explicit mapping of identifiers, scopes, tokens, trust anchors, and revocation signals.
Models are probabilistic. The system proposing an action should not be the sole system deciding whether the action is authorized.
Prompt injection changes context. Exposure to untrusted content should reduce authority or trigger additional approval, not leave permissions unchanged.
Audit needs context. A log that says an API call occurred is insufficient without the request, policy decision, delegation chain, sponsor, and outcome.
Therefore, scale should follow an authority proof. Before autonomy expands, a bounded test must prove identity, least privilege, cross-boundary consistency, revocation, and reconstruction.

The strongest counterargument is that per-action authorization adds latency and complexity. It does. The answer is proportional control: low-risk read-only actions can use pre-approved policies and cached decisions, while money movement, external communication, sensitive data, production changes, and sub-agent creation require stricter runtime evaluation.

Four operating options

Option	When it can work	Main advantage	Main failure mode
Borrow the user's identity	Short-lived, supervised productivity tasks with no consequential external action.	Fast implementation and familiar access paths.	The agent inherits unrelated permissions and human/machine actions cannot be separated.
Shared service identity	Narrow deterministic automation with one owner, one purpose, and no delegation.	Operational simplicity.	Multiple agents become indistinguishable; credentials persist and compromise spreads.
Distinct agent identity with static roles	Stable internal agents operating in a controlled domain.	Better inventory, attribution, and revocation.	Static roles still over-authorize changing tasks and sub-agent chains.
Task-scoped agent identity and runtime authorization — recommended	Production agents that cross tools, data domains, providers, or organizational boundaries.	Preserves sponsor, purpose, least privilege, lineage, expiry, and control at action time.	Requires policy engineering, interoperability testing, and disciplined identity operations.

Use the lightest option consistent with consequence. The fourth option should be mandatory when an agent can spend money, change production, access sensitive data, communicate externally, create credentials, or delegate to another agent.

Five CEO decision gates

1. Identity and sponsor gate

Require a complete inventory of production agents and sub-agents. Each must have a distinct identity or verifiable run identity, a named business owner, a technical custodian, a human or institutional sponsor, and an approved purpose.

If the organization cannot distinguish the agent from the user, another agent, or a generic service account, it cannot attribute action or revoke the correct actor.

2. Task and authority gate

Define authority as a task contract: intended outcome, allowed resources, prohibited actions, transaction or data limits, time window, geography, and escalation conditions. Issue ephemeral credentials whose permissions narrow—not expand—as work moves down the delegation chain.

A prompt is not the contract. The contract must be machine-enforceable outside the model.

3. Runtime enforcement gate

Evaluate every consequential tool call and API interaction against deterministic policy at action time. Include agent identity, sponsor, task, target resource, scope, data classification, confidence, untrusted-input exposure, and separation-of-duty requirements.

Let the model supply context, not the final authorization decision. If the agent encounters a new resource or suspicious input, reduce authority, require approval, or stop.

4. Lineage and cross-boundary gate

Preserve the original principal, intent, parent-child lineage, scope changes, policy decisions, approvals, and execution evidence across agents, tools, and providers. Test how each boundary translates identity, consent, scopes, expiry, and revocation.

Do not assume interoperability because both systems use OAuth, MCP, or another common protocol. Shared syntax does not guarantee shared meaning.

5. Revocation and reconstruction gate

Prove that the organization can stop one agent or one task without disabling unrelated workflows. Revocation must terminate credentials, sessions, network paths, tool access, and spawned sub-agents, then preserve the evidence needed to reconstruct what happened.

If an agent can act faster than the organization can revoke and explain it, the autonomy level exceeds the control system.

Decision rights

CEO action	What it means
Decide	Which consequences may be delegated; maximum agent authority; actions requiring human approval; sponsor accountability; and scale, escalation, and stop thresholds.
Delegate	Identity architecture to the CISO/CIO; policy engineering to platform and security teams; task contracts to business owners; legal, privacy, and risk constraints to control functions.
Instrument	Agent inventory, orphaned identities, credential age, effective permissions, per-action policy decisions, delegation depth, denied actions, revocation time, exceptions, and evidence completeness.
Escalate	Cross-border or cross-provider ambiguity, authority that cannot be expressed in policy, sensitive-data aggregation, conflict of duty, lost lineage, repeated overrides, or delayed revocation.
Stop	Agents using personal credentials; long-lived secrets for dynamic tasks; sub-agents with broader scope than parents; model-only authorization; or any workflow that cannot be revoked and reconstructed.

The business owner remains accountable for the outcome. Identity and security leaders own the control plane. Platform teams own enforcement integration. Legal, privacy, compliance, and risk leaders define consequence boundaries. The CEO resolves trade-offs between speed, friction, control cost, and institutional trust.

The 60-day smallest credible test

Test one production-like agent that performs a bounded multi-step task across at least two systems. Choose a workflow with meaningful but reversible consequences; avoid starting with irreversible safety, rights, or large-value financial decisions.

Days 1–10: build the identity and authority record

Inventory the agent, runtime, model, tools, data, credentials, owner, sponsor, and any sub-agents.
Define the task contract, permitted targets, prohibited actions, transaction or data limits, expiry, and approval triggers.
Measure the current baseline: credentials used, effective permissions, authorization latency, manual approval time, exception rate, and audit completeness.
Name success, failure, escalation, and stop conditions before integration changes.

Days 11–25: separate reasoning from control

Issue a distinct agent identity and per-run credentials bound to the stable trust anchor.
Put a deterministic policy-enforcement point in front of every consequential tool and API.
Configure task-scoped permissions, decreasing scope for sub-agents, short expiry, destination controls, and separation of duty.
Correlate identity, policy, tool, network, and outcome records with one run identifier.

Days 26–45: challenge authority boundaries

Attempt out-of-scope data access, tool use, external communication, value transfer, and sub-agent creation.
Introduce untrusted content and verify that authority is reduced, approval is required, or the action is blocked.
Cross one provider or security boundary and confirm that identity, scope, expiry, and revocation retain the same meaning.
Revoke the task mid-run and verify termination of credentials, sessions, tool access, network paths, and descendants.

Days 46–60: hold the identity gate

Scale when every consequential action is attributable to a unique agent/run and sponsor; no child scope exceeds its parent; policy is enforced outside the model; revocation stops the complete chain; and the evidence reconstructs request, decision, delegation, approval, and outcome.
Redesign when control works but latency, false denials, approval load, cross-domain translation, or operational cost exceeds tolerance.
Stop when any agent is orphaned, credentials outlive the task, lineage is lost, the model can bypass policy, or revocation leaves a route to data, tools, money, or external communication.

Illustrative local thresholds can include 100% of consequential actions evaluated by the control plane; 100% traceability to agent, run, sponsor, and task; zero permission expansion in sub-agent chains; zero active credentials after task expiry; revocation completed within 60 seconds; and full reconstruction of sampled runs. These are design examples, not external benchmarks. Each organization must set thresholds from consequence, obligations, architecture, and risk appetite.

Decision gate

Scale an AI agent only when all five statements are true:

The agent and every sub-agent have a verifiable identity and accountable sponsor.
Authority is task-scoped, time-bound, least-privileged, and narrower at each delegation hop.
Consequential actions are authorized by a deterministic control plane outside the model.
Identity, intent, scope, lineage, expiry, and revocation survive every boundary the agent crosses.
The organization can revoke the complete chain and reconstruct each action from request to outcome.

If one statement is false, keep the agent read-only, supervised, isolated, or limited to a smaller task. Do not let broad user credentials or a successful demo substitute for authority evidence.

Implications for decision-makers

For CEOs: treat agent identity as a business-control decision. Decide delegated consequences and require an authority proof before expanding autonomy.

For boards: ask how many production agents exist, which actions they can take, whose authority they use, what expires automatically, and how the last revocation test performed.

For CIOs and CISOs: extend identity governance to non-human agents, separate model reasoning from authorization, and make cross-boundary scope translation testable.

For COOs and business owners: express the business task as enforceable limits, not a broad objective. Own exceptions and approve consequence thresholds.

For legal, privacy, risk, and compliance leaders: define sponsor liability, consent, data minimization, non-repudiation, retention, and human-approval obligations before deployment.

For finance leaders: evaluate control-plane cost against the blast radius of ambient credentials, unauthorized transactions, remediation, downtime, and loss of trust.

Testable hypotheses

Distinct agent identities will reduce attribution gaps compared with agents operating through employee or shared-service accounts.
Task-scoped ephemeral credentials will reduce effective permission and orphaned-access exposure without preventing the intended workflow.
Deterministic per-action policy enforcement will block out-of-scope behavior more reliably than prompt-level guardrails alone.
Delegation-chain tests will reveal permission expansion that ordinary role reviews miss.
A rehearsed full-chain revocation will predict controllability better than the existence of a kill switch in one application.

These hypotheses require company data. External evidence defines the decision architecture; it does not predict one organization's risk reduction or productivity.

Continue reading

Source notes

Evidence reviewed 23 October 2026.

NIST NCCoE, Summary of Comments on the Software and Agentic AI Identity and Authorization Concept Paper, published 29 September 2026.
NIST, Back to the Future: Why Agentic AI Needs a Strong Identity Foundation, 27 August 2026.
OpenID Foundation, A Protocol-Agnostic Threat Classification for Cross-Boundary AI Agent Authorization, 12 October 2026.
OWASP GenAI Security Project, Agent Control Standard, 1 September 2026.
OWASP GenAI Security Project, GenAI and Agentic AI Exploit Roundup Q3 2026, 8 October 2026.
ASEAN, Expanded ASEAN Guide on AI Governance and Ethics — Generative AI, January 2025.

Geographic limit: the identity and authorization evidence is global, led by U.S.-based standards and security bodies. The ASEAN guide provides regional governance context, but organizations must apply Indonesian and sector-specific requirements to their own use cases.

About the author

Antovany Reza writes CEO Decision Lab, an independent decision platform for AI-fluent CEOs and senior leaders turning AI and digital transformation into business value, stronger judgment, and accountable execution.

Discuss this decision

Which agent in your organization has the broadest effective authority—and can you prove who sponsored every action it takes? Start a conversation with Antovany Reza.

LinkedIn · X · Facebook · WhatsApp

Discuss a decision with Antovany Reza