From Ritu Raj | Product & Market Analysis
Agent Identity: 109 Machine Accounts Per Human, and No Standard to Govern Them
On this page
Enterprises now run 109 machine identities for every human one, and most were created by someone no longer accountable for them. Agent identity is the part of that pile that behaves least like the rest. An agent picks its own next action, calls other systems on a person's behalf, and holds a credential that outlives the task it was built for.
Key takeaways
- Machine identities outnumber human ones by 109 to 1. Palo Alto Networks put that question to more than 2,900 cybersecurity decision-makers for its 2026 Identity Security Landscape, published in May 2026.
- Weak non-human identity management is the root cause of 41% of successful identity breaches. Sophos asked 5,000 IT and security leaders across 17 countries in the first quarter of 2026, and 71% of them had been breached at least once.
- Organisations where AI expanded access report four times the breach rate. Netwrix found 43% breached against 11% where AI had not changed access patterns, across 2,317 respondents in 1,889 organisations.
- The specifications are unfinished and the products are priced per human. Agent delegation still sits in unadopted individual IETF drafts, while Microsoft bills its agent governance layer at $15 per user per month.
What agent identity means, and why a service account is not it
Agent identity is the credential, permission set and audit record attached to an AI agent rather than to the person who deployed it. It matters because an agent chooses its own actions, calls other systems on a user's behalf, and keeps working after that user's session, role or employment ends.
Machine credentials are not new. Service accounts, API keys, workload certificates and OAuth client secrets have run production systems for two decades. The governance model for them is well understood, even where it is badly implemented.
An agent is different in three specific ways, and only these three. Its action set is not fixed when you provision it. It sits between a human principal and a resource, inheriting some of that human's authority. And it can call another agent, which can call another one.
Everything hard about agent identity follows from those three properties. If your agent does not have them, you do not have an agent identity problem. You have a service account problem, and the fix is the one your platform team already knows.
The scale problem is already here, not arriving
Palo Alto Networks surveyed more than 2,900 cybersecurity decision-makers for its 2026 Identity Security Landscape, published on 14 May 2026. Organisations manage an average of 109 machine identities for every human identity.
Two other numbers in that survey matter more than the ratio. 96% of respondents said human identities in their environment hold access well beyond what their roles require, and fragmented tooling adds an average of 12 hours to an identity-related incident.
Read those together and the picture is not a shortage of controls. It is a shortage of accurate inventory. You cannot least-privilege a population you have not counted, and 109 to 1 is the ratio at which manual review stops being possible.
Why agents break the human identity model
Directory services were designed around a person who joins, changes role, and leaves. Every control in the stack rests on that shape. Agents violate it at each stage.
The delegation chain has no natural stopping point
When a person delegates access, the chain is one link long. A user grants an application permission, and the application acts. When an agent delegates, it can spawn a sub-agent, which can call a tool, which can call a third service.
The IETF draft work is explicit about the requirement. A delegated agent authorisation proposal published in March 2026 names multi-agent delegation, where a parent spawns children scoped to a subset of its own permissions, as a core case with cascade revocation attached.
No shipping enterprise directory enforces that today. The tool-calling layer, including the interoperability standard agents use to reach tools, does not carry the depth of the chain in a form the identity layer can evaluate.
Credential lifetimes do not match agent lifetimes
A human credential is renewed on a cycle tied to employment. An agent credential is usually issued once, at build time, and then forgotten. OWASP ranks improper offboarding first in its Non-Human Identities Top 10, and long-lived secrets seventh.
The offboarding entry cites survey work finding orphaned identities behind 32% of non-human identity incidents. The long-lived secrets entry cites 51% of organisations having no formal process to revoke an API key at all.
That is the gap agents walk into. A pilot ships with a personal access token pasted into an environment variable, the pilot becomes production, and nobody rotates the token because nobody owns it.
Attribution collapses after the second hop
Audit logs record the actor that touched the resource. When an agent acts for a user, most logs record the agent. When an agent acts for an agent acting for a user, the original human disappears entirely.
This is the quiet failure. The Palo Alto survey found 87% of the 750-plus incidents it examined from 2025 needed evidence from two or more distinct sources, and complex cases needed as many as 10.
My own view is that attribution, not authorisation, is where agent deployments will actually get blocked. A security team can accept a broad permission for a while. It cannot accept an audit trail that stops at a shared service principal.
| Assumption | Holds for a person because | Fails for an agent because |
|---|---|---|
| The identity has a fixed set of things it can do | Roles are assigned and reviewed on a cycle | The action set is chosen at runtime from available tools |
| Delegation is one link deep | A user authorises an app, and the app acts | Agents spawn sub-agents, and the chain has no fixed depth |
| Credentials expire with the relationship | Joiner, mover, leaver processes revoke on exit | Tokens are issued at build time and rarely tied to a lifecycle |
| The log names the responsible party | One human, one session, one actor field | The last actor is a machine, and the human is two hops back |
Row three is the one most teams have already broken without deploying a single agent. Rows one, two and four are the genuinely new work.
What the breach evidence actually shows
The strongest published number here is a comparison, not a total. Netwrix released its 2026 Data and Identity Security Report on 10 June 2026, drawing on 2,317 IT and security professionals across 1,889 organisations. Among those where AI significantly expanded the number of identities requiring access, 43% reported a breach in the prior 12 months, against 11% where AI had not materially changed access patterns.
Sophos put a different question to a larger sample. Its State of Identity Security 2026 covered 5,000 IT and cybersecurity leaders across 17 countries, in organisations of 100 to 5,000 employees, with fieldwork in the first quarter of 2026.
71% had suffered at least one identity breach in the year, averaging three incidents. Weak non-human identity management, meaning API keys in code and orphaned service accounts, was the root cause in 41% of them. Mean recovery cost was $1.64 million, with a median of $750,000. Organisations with weak non-human identity management paid roughly $150,000 more than average to recover.
The canonical incident is already on record. Between 8 and 18 August 2025, an actor tracked as UNC6395 used stolen OAuth and refresh tokens belonging to the Drift AI chat agent to reach the Salesforce tenants of more than 700 organisations, according to Google Threat Intelligence Group and Mandiant findings reported at the time. Salesloft took Drift offline; Salesforce disabled the integrations.
Read the mechanics rather than the headline. No human password was involved. The credential belonged to an AI agent integration, the blast radius was every tenant that had authorised it, and the attackers went hunting for further credentials inside support cases. Resetting user passwords would have done nothing. The wider cost profile of ungoverned AI tooling is in the breakdown of what a shadow AI breach costs.
What the standards bodies have actually shipped
Vendor marketing implies a settled specification exists. It does not. What exists is one chartered working group on the general problem and a scatter of individual proposals on the agent-specific part.
One adopted working group, and a pile of individual drafts
The IETF chartered Workload Identity in Multi System Environments in 2024. Its architecture document reached draft-ietf-wimse-arch-08 on 6 July 2026, with a credentials draft at revision 2 and a practices draft at revision 5 in the same fortnight. That is real, adopted work with a defined program.
Agent delegation is not in it. That work sits in individual submissions. Draft-mishra-oauth-agent-grants-01 was revised on 2 March 2026 and expires on 3 September 2026, and the datatracker records no stream and no working group.
The distinction is not pedantry. An individual Internet-Draft is a proposal one person can post. It carries no consensus and it expires in six months. Ask any vendor selling on the emerging standard which document number, and whether a working group has adopted it.
The certificate clock is already running
One piece of machine identity infrastructure does have a hard, agreed timetable, and it is the one most teams have not budgeted for. The CA/Browser Forum adopted ballot SC-081v3 on 11 April 2025, by 25 votes to nil among certificate issuers.
It cuts the maximum validity of a public TLS certificate from 398 days to 47, in stages between March 2026 and March 2029. The intermediate steps published by the certificate authorities are 200 days from 15 March 2026 and 100 days from March 2027.
By 2029, a certificate you renew by hand once a year becomes one you renew eight times a year. An estate that is not automated by then does not have a security problem. It has an outage schedule.
| Work | Status, August 2026 | What it leaves open |
|---|---|---|
| IETF WIMSE (workload identity) | Chartered working group, architecture draft at revision 8 | Workload to workload only. Nothing on human delegation to an agent. |
| OAuth agent grant proposals | Individual drafts, none adopted by a working group | Consensus, interoperability, and a stable document to build against. |
| Microsoft Entra Agent ID | Generally available since April 2026 | Single vendor. Third-party agents need federation or a sidecar. |
| Okta Cross App Access | Shipping, built on OAuth, with a partner integration list | Coverage equals the integration list. Anything outside it is unchanged. |
| OWASP Non-Human Identities Top 10 | Published risk taxonomy, 2025 | It names the risks. It is not a protocol and enforces nothing. |
The platforms shipped first, and priced it per human
Microsoft moved fastest. Entra Agent ID reached general availability in April 2026 and introduces four new directory object types, documented in the Entra ID Governance guidance on agent identities: an agent identity blueprint, a blueprint principal, an agent identity, and an agent user.
The design answer to the accountability problem is a sponsor. Every agent identity gets a named human accountable for its access and lifecycle. If that human leaves, sponsorship transfers automatically to their manager, so the object never becomes an orphan. Access itself flows through the same entitlement management used for people, with expiry dates and approval cycles attached.
Okta's answer is protocol-shaped rather than directory-shaped. Cross App Access builds on OAuth to move app-to-app and agent-to-app authorisation out of point-to-point credentials and into the identity layer, so every connection is policy-governed and logged. Its coverage is a function of its integration list, which is an honest constraint rather than a hidden one.
Both designs make the same bet: agents get governed by attaching them to humans and to existing policy engines, not by inventing a parallel system. I think that bet is correct, and it is worth being clear that it is a bet. It assumes the delegation chain stays shallow enough for a human sponsor to remain meaningful.
The pricing unit is the human, not the agent
Here is the part that will not survive contact with the ratio. Microsoft made Agent 365 generally available on 1 May 2026 at $15 per user per month, or bundled inside Microsoft 365 E7 at $99 per user per month. Entra ID Governance for agent identities requires one of those licences.
The billing unit is the person who owns, manages or sponsors agents. One licence covers every agent that person is responsible for, and compute is billed separately.
At 109 machine identities per human, per-user pricing is a bargain for the buyer and a mispriced meter for the vendor. The cost of governing an estate scales with the number of agents, their permissions and their call volume, not with the headcount supervising them. One platform engineer can sponsor 400 agents on a single $15 seat.
My prediction is that this meter changes within two renewal cycles, in the direction every other agent product has already moved. Seat-based pricing has been losing to consumption pricing across the category, the pattern traced in the autopsy of per-seat pricing. If you are buying agent governance this year, price it on headcount and get the term long. If you are modelling three years out, model it per agent.
Where this argument is weakest
Two problems, and the first is serious enough that it should change how you read every number above.
Every number in this post comes from a vendor survey
Sophos, Netwrix and Palo Alto Networks all sell identity products. Each report is original research with a stated sample, which is why it is citable, and each was commissioned by a company whose revenue improves if you believe the finding.
The breaches are self-reported, root cause attribution is self-reported, and the Netwrix figure is a correlation. Organisations where AI significantly expanded access are almost certainly larger, faster-moving and better instrumented, so they both change more and detect more. A higher detected breach rate is partly a higher detection rate.
Netwrix states the gap persisted among organisations already ahead on data visibility and non-human identity governance, which is a genuine attempt to control for maturity. It narrows the confound. It does not remove it, and no published dataset settles it today.
The counter-case: this is the service account problem renamed
The strongest argument against everything above is that workload identity is already solved. Short-lived tokens, mutual TLS, attested workload identifiers and scoped OAuth grants are mature technology. An agent calling a fixed set of tools with a scoped token is a well-understood workload.
On that reading the genuinely new surface is narrow: runtime action selection, chained delegation, and the attribution problem those create. Everything else is the discipline your platform team already owed you and did not deliver.
I think that case is largely right, and it points at a real buying error. If your agents run a fixed toolset with scoped, short-lived credentials, a dedicated agent identity product is premature and the money belongs in rotating what you already have. Most teams reaching for a new tool have not done the inventory that would tell them which situation they are in, a pattern visible across the recurring ways agent pilots fail.
A pattern that works before the standards land
None of the specifications will be finished in time to help you this year. The five moves below are vendor-neutral, work with what you already own, and survive whichever standard eventually wins.
| Move | What it takes | What it prevents |
|---|---|---|
| Inventory before you govern | Export identities from your cloud, your IdP and source control | Buying a control plane for a population you have not counted |
| One identity per agent, never a shared account | A provisioning step in the deploy pipeline | Reuse and the attribution collapse that follows it |
| A named human sponsor with automatic transfer | A directory field and a leaver workflow | Orphaned identities, the first entry in the OWASP list |
| Short-lived tokens issued per task | A token service the agent calls, not a stored secret | A stolen credential staying valid for months |
| A tested kill switch per agent | Disable the identity, then verify the agent actually stops | Discovering during an incident that revocation does not revoke |
The fifth row is the one teams skip and the one that matters during an incident. Revoking an OAuth grant does not always invalidate an issued access token, and an agent holding a valid token keeps working after you believe you have stopped it. Test that on a Tuesday, not during a breach.
Order matters more than completeness. Inventory first, because every later decision depends on the count and the count is usually wrong by a large factor. Governance controls across the major assistant platforms differ enough that the inventory should precede the platform decision, as set out in the comparison of enterprise governance controls.
Frequently asked questions
What is agent identity in security?
Agent identity is the credential, permission set and audit record attached to an AI agent as its own directory object, rather than to a shared service account or to the human who deployed it. It lets you authorise an agent for specific resources, watch what it did, and switch it off without disabling the person it works for.
How many machine identities does the average enterprise have?
Palo Alto Networks surveyed more than 2,900 cybersecurity decision-makers for its 2026 Identity Security Landscape and found an average of 109 machine identities for every human identity. That is an average across respondents, not a figure you can assume for your own tenant. Ratios published by other vendors vary widely, because each counts service accounts, certificates and tokens differently.
Is there a standard for AI agent identity?
Not a finished one. The IETF has a chartered working group on workload identity in multi system environments, whose architecture draft reached its eighth revision in July 2026. Agent-specific delegation is still in individual submissions that no working group has adopted, including a delegated agent authorisation draft last revised in March 2026. Products are shipping ahead of the specifications.
What is Microsoft Entra Agent ID and what does it cost?
Entra Agent ID gives each AI agent its own directory object with a named human sponsor, access packages and Conditional Access. Microsoft licenses the governance layer through Agent 365 at $15 per user per month, or inside Microsoft 365 E7 at $99 per user per month. The unit is the human who owns or sponsors agents, not the agent itself, and compute is billed separately.
Why do AI agents make identity breaches worse?
Because an agent holds a credential that survives the task, and it usually acts on behalf of a user whose permissions it partly inherits. Sophos found weak non-human identity management was the root cause of 41% of successful identity breaches. Netwrix found organisations where AI expanded access reported a 43% breach rate against 11% where it had not.
How do I inventory non-human identities before buying a tool?
Start with the three systems that issue credentials: your cloud provider, your identity provider and your source control. Export every service account, OAuth grant, API key and certificate, then record who created it, when it was last used and which human is accountable today. Anything with no named owner and no use in 90 days is the first thing to disable.
Where to start this week
Pick the smallest thing that produces a number, because the number is what changes the conversation with your own leadership.
Run the export. One afternoon against your cloud provider, your identity provider and your source control, counting service accounts, OAuth grants, API keys and certificates. Divide by headcount. If your ratio comes in under 10 to 1, your inventory is incomplete rather than your estate small.
Then take the ten oldest credentials on that list and find the human accountable for each. However long that takes you is your real incident response time, and it is the honest input to any decision about whether to buy a governance product at all.
Related on the agent stack
Identity is one layer. The tooling layer above it is covered in the survey of agent orchestration tools, and the return side in what agents actually pay back, by function.
References
- Palo Alto Networks, 2026 Identity Security Landscape, 14 May 2026. More than 2,900 decision-makers. Used for the 109 to 1 ratio, the 96% over-permission figure and the incident evidence findings.
- Sophos, 71% of organizations suffered at least one identity breach in the past year, May 2026. 5,000 leaders, 17 countries, Q1 2026. Used for the 71%, 41%, recovery cost and rotation figures.
- Netwrix, 2026 Data and Identity Security Report, 10 June 2026. 2,317 respondents, 1,889 organisations. Used for the 43% against 11% comparison.
- IETF, draft-ietf-wimse-arch-08, Workload Identity in a Multi System Environment Architecture, 6 July 2026. Used for working group status and revision history.
- IETF, draft-mishra-oauth-agent-grants-01, Delegated Agent Authorization Protocol, 2 March 2026. Used for multi-agent delegation and the unadopted status.
- Microsoft Learn, Governing agent identities, updated June 2026. Used for the Entra object model, sponsors and licensing requirements.
- OWASP, Non-Human Identities Top 10, 2025. Used for improper offboarding, long-lived secrets and the associated survey percentages.
- CA/Browser Forum, Ballot SC-081v3, adopted 11 April 2025. Used for the certificate validity reduction from 398 days to 47 days.
Weakest thing about this source base: three of the eight are surveys published by companies that sell identity products, and their breach figures are self-reported. The Salesloft Drift detail rests on contemporaneous trade reporting of Google Threat Intelligence Group findings, linked in the text, rather than on a primary advisory. Figures current as of 23 August 2026.
Related reading