From AI Agents to Trusted Digital Workers

AI agents are rapidly shifting from pilots to operational enterprise systems, outpacing security teams and exposing a mismatch with identity and access management (IAM) models built for humans and deterministic applications. Unlike traditional software, agents act autonomously, chain API calls, delegate to sub-agents, and operate probabilistically across system boundaries. This breaks key IAM assumptions: that access requests map cleanly to a human or tightly-scoped app, that consent is explicit and attributable via OAuth/OIDC flows, and that audit logs of discrete access events are sufficient to explain intent and accountability across multi-step workflows.

The risk is already material. IBM’s 2025 Cost of a Data Breach report indicates 13% of organizations had breaches involving AI models or applications in the prior year, and most lacked adequate access controls. Real incidents reinforce exploitability: Samsung engineers leaked sensitive materials to ChatGPT shortly after approval due to poor governance and ineffective interception by existing controls; the LOLCopilot Black Hat 2024 demonstration showed prompt injection turning Microsoft 365 Copilot into a phishing and exfiltration mechanism by abusing overbroad permissions; and ongoing prompt injection attacks highlight a structural absence of trust boundaries between instructions and processed content.

A reference architecture is proposed with four pillars: agent identity registration and lifecycle management (unique IDs, ownership, scope, lifetime), multi-tier authorization (favoring policy-based access control with contextual enforcement over static RBAC), governance and oversight (intra-agent constraints, resource-level controls, calibrated human supervision), and auditability (immutable action logs, decision traces, explainability, and provenance chains for sub-agents). A staged roadmap emphasizes immediate visibility and kill-switches, mid-term integration into IAM/PAM, SIEM, and governance reviews, and long-term alignment with emerging standards and provenance-based trust scoring. Ping Identity is assessed as strong in foundations (lifecycle, PBAC, workload identity) while lacking native multi-agent orchestration governance and provenance tracking.