Autonomous agents and agentic AI are fairly new concepts in IAM and were initially considered non-human identities (NHIs). However, there is evidence that this initial classification is only partially correct. While AI agents are certainly not human identities, the NHI category also does not cover them completely. This points to a gap that the current differentiation does not capture. Like many organizations, we first placed AI agents in the NHI category. After a closer look, it is not as simple as we assumed.
Two Categories of Identity: Human and Non-Human
IAM has traditionally worked with two categories of actors, human and non-human identities. The distinction rests on ownership, lifecycle, and accountability.
A human identity represents a person. The person acts autonomously within an assigned role and holds discretion over how a task is carried out. Beyond technical controls, a person is bound by intrinsic ethics and by the organization itself. Acting against one’s own employer carries consequences. This binding is not perfect. Accidents happen and insider threats exist. The framework of judgment, responsibility and moral accountability still applies.
A non-human identity represents a technical actor such as a service, a script or a scheduled job. Its purpose, authority and decision logic are defined before runtime. A service retrieves a file, calls an API or synchronizes two systems. The implementation may be complex and the environment may change. A predefined process still determines the response. Organizations can therefore document its purpose, limit its authority, protect its credentials and manage its lifecycle.
An AI agent can execute actions and entire workflows autonomously. Its defining trait is that it combines reasoning with operational execution. The same properties create new exposure. Autonomous behavior is difficult to control and AI agents often require extensive system permissions. Furthermore, accountability and governance remain open challenges.
These challenges are not coincidental. They arise because an AI agent does not fit neatly into either category. It combines properties that the two established categories clearly distinguish. Ownership and lifecycle place it among non-human identities. The way it behaves and decides places it closer to a human one. Neither category was designed for an actor that is a mix of both worlds.
Where the Non-Human Label Breaks
The break becomes visible in practice, not just in theory. When Eleni Richter of EnBW spoke at the European Identity and Cloud Conference 2026 about the shift from backup jobs to AI agents, she distinguished deterministic services from complex NHIs that use AI to simulate human behavior. That line is where the classification comes under strain. A conventional non-human identity receives a defined process. An AI agent may receive an objective without a complete path to the outcome. It can interpret information, select tools, evaluate results and adapt its next action. The same objective and the same authority can produce different execution paths, because the decisions are made at runtime.
This is where the agent resembles a human identity. A person also receives an objective and holds discretion over the path. The resemblance ends at accountability. For human identities, organizations rely on approvals, separation of duties and monitoring, and on the ethical and organizational binding that a person carries. An AI agent holds the discretion without that binding. The controls built for non-human identities do not close this gap, because they are static and limited to the deterministic actions those identities were expected to perform.
This leaves the agent in a difficult position. Discretion is present. The internal constraint that would normally limit it is absent. Additionally, the controls available on the non-human side do not extend to the decisions made by the agent. In this respect, the agent behaves like a permanent insider threat, without the intent usually implied by the term.
A Valid Identity Making a Wrong Decision
A short example makes this concrete. It follows an AI agent through a routine finance task and shows both sides of the actor at once.
Consider a finance team that uses an AI agent to process supplier invoices placed on hold. The agent can review supplier records and previous correspondence, and it may release a hold once a discrepancy has been resolved. In ownership and lifecycle this agent is a non-human identity. It was provisioned by finance operations, it has a documented purpose and approved authority, and it can be terminated like any other service account. That is the non-human side, and it is fully in order.
One invoice arrives with bank details that do not match the supplier record. The agent finds an email asking finance to use the new account and treats it as sufficient confirmation. It releases the hold. That is the wrong decision. A single email is not sufficient evidence for a change of bank details.
Here the human-like side takes over. A conventional non-human identity receives a defined process and would have followed a fixed rule, either passing the mismatch on or stopping. This agent instead received an objective and worked out the path itself. It interpreted the email, judged it trustworthy and chose to release the hold. The decision was made at runtime. On another day the same objective could have produced a different outcome. This is human-like discretion, sitting inside an actor that is non-human in every other respect.
This is where the example turns dangerous. A person in the same role holds the same discretion but carries the binding that goes with it. That person might have paused at an unusual change of bank details, aware that a wrong release would be traced back to them. The agent carries nothing comparable. From an access perspective nothing went wrong. The identity was valid and the access was approved. The wrong decision was made inside approved authority, which is what makes it hard to detect.
Are We Solving the Wrong Puzzle?
Clearly, an agent is not a human identity. Nor is it entirely a non-human one. The label 'agent' identifies the actor, but does not express the degree of discretion between an objective and an outcome.
The missing piece may not be another identity type at all. We may be assembling the wrong puzzle. The distinction between human and non-human answers one question and establishes where ownership, lifecycle and accountability reside. However, it does not address the second question of how closely the actor’s decisions must be governed. What separates the invoice agent from a conventional service is not ownership, because both are non-human. It is autonomy. The service follows a defined process. The agent decides at runtime.
The obvious responses fall short. Restricting permissions sets the outer boundary and nothing beyond it. The invoice agent may review a hold and release it. That permission alone does not determine whether release is appropriate in a specific case. Clear instructions do not reach further either, because the agent has to interpret them. When a rule conflicts with an objective, the agent may favor the objective and cross the boundary without malicious intent.
Accountability does not change. Autonomy changes how an action is selected. It cannot transfer responsibility to the agent. Ownership therefore has to cover more than the resources and operations available. It has to cover the decisions the agent may make and the conditions under which it may make them. It is not settled where those conditions belong or who defines them.
Conclusion: An Open Question Remains
Classifying an AI agent as a non-human identity is correct in ownership and lifecycle. It is incomplete as a control profile. The label captures who is accountable. It does not capture how much the actor decides on its own.
An agent can hold a valid identity and approved access and still make a dangerous decision. The discretion is present. The internal constraint that normally limits it is absent. A better identity label does not change that.
However, if agents are non-human in ownership but human-like in discretion, can IAM still govern them on the human versus non-human distinction alone?
