IAM was built for humans
Identity and Access Management has always answered one question: who can access what, and under which conditions. For decades the “who” was easy to pin down: a person, a service account, an application.
Enterprises are now deploying autonomous agents that act without constant human direction, talk to other agents and invoke APIs. IAM is shifting from governing identity to governing intent.
What is an agent, in IAM terms?
An AI agent is more than a bot. It makes context-driven decisions and may represent a persona, a role or a temporary objective. It may live for minutes, call other agents and span several systems.
Agents don't fit existing categories: not fully human, not simply service accounts, and never static. That is the first fracture in traditional IAM, which was designed around stability.
Static identity meets dynamic behaviour
Traditional IAM assumes users hold roles and service accounts are bound to fixed policies. Agents are created on the fly and may exist for a single workflow.
Take a procurement agent. Give it permanent access and you widen the attack surface. Share a service account and you lose accountability. Let it inherit a human's permissions and responsibility blurs.
Where traditional IAM strains
Most IAM evaluates identity, role, group and predefined policy. Agentic systems add variables that are rarely evaluated together: why the action is happening, which workflow step it belongs to, how long access should last, and who delegated the authority.
When intent, context, scope, duration and delegation aren't assessed together, authorization is incomplete, and incomplete authorization is risk.
The agent-to-agent problem
One agent calls another, which calls further services. Who authorized the first agent? Should the second trust that authority automatically? Can privileges escalate along the chain?
Without explicit delegation controls and continuous checks, these chains enable privilege amplification, lateral movement and hidden access paths.
Identity is no longer singular
With persona-based execution, one agent may act as a finance reviewer, a compliance checker or a support assistant depending on context. Each persona needs different boundaries.
Authorization has to become situational, tied to context rather than permanently attached to an identity.
Toward ephemeral, context-aware access
Access for agents should be granted just in time, scoped to a single objective, evaluated continuously and revoked automatically when the task ends, taking into account data sensitivity, environment, workflow stage and delegation lineage.
The question moves from “Who are you?” to “What are you trying to do, under whose authority, and for how long?”
Can IAM govern the agentic era?
Yes, if it evolves. IAM must treat agents as first-class identities, with fine-grained authorization, short-lived credentials, delegation governance and explainability: the ability to say why access was granted at a given moment.
Organizations that bolt IAM on afterwards will meet compliance failures and incidents. Done right, IAM becomes more central than ever, governing intent, context, delegation and accountability.