Every security team already has an identity stack. Employees sign in through single sign-on, services authenticate with workload identity, and secrets live in a vault. So when the first AI agents arrive, the natural move is to treat them like another service: give them an API key, a role, and move on.
That works until the agent does something nobody intended. Then three assumptions behind the identity stack turn out not to hold.
Assumption 1: the subject is predictable
A payroll service calls the same endpoints in the same order every night. A role that allows those calls is a reasonable description of what it will do.
An agent is different. Given the same goal, it may take a different path every run: look up an order, check a policy document, decide a refund is due, and issue it. The role says what it could do; it says nothing about whether this refund, for this amount, right now, should happen.
For agents, authorization has to move from login time to call time, and it has to look at the arguments.
Assumption 2: the subject acts for itself
A service does what its code says. An agent does what its context says, and its context includes text written by strangers: customer emails, support tickets, web pages, documents. A carefully worded email can turn a helpful support agent into one that exports the customer list.
No credential check catches that, because the credentials are valid. What catches it is knowing what the agent read before it acted, and treating "untrusted input, then a private read, then data leaving" as the pattern it is.
Assumption 3: identities are few and long-lived
Agents spawn sub-agents, share keys between environments and outlive the projects that created them. Within months, nobody can say which agents exist, who owns them or what they can reach.
Governance therefore has to include the whole lifecycle: registration with a named owner, delegation that can only narrow, recertification, and retirement that revokes everything an agent ever issued.
What an agent identity layer has to do
- Know every agent, with an accountable person, a purpose and a risk tier.
- Issue short-lived credentials, with keys in a hardware-backed vault, and delegation that only ever narrows.
- Decide every call before it runs, including its arguments, and hold irreversible actions for a person.
- Watch patterns across calls, not just individual requests.
- Record everything tamper-evidently, before the action, so the evidence exists even if the action fails.
- Let a person stop any agent in one step.
None of this replaces your existing identity stack. It sits next to it, governing the subjects that stack was never designed for. That is what we built Sentinel NHI to do.
Read the NHI Governance Framework or see Sentinel govern a live agent fleet.