Agent Identity Is the Control Plane. Most Enterprises Skip It.

Who Was That? The Agent Identity Question Nobody Can Answer

by Dr. Harish Kotadia

When an agent acts inside your systems, the first question a regulator, an auditor, or an incident responder will ask is simple. Who was that?

For most enterprises, there is no good answer. In a 2026 survey the Cloud Security Alliance ran with Aembit, more than two-thirds of organizations could not clearly distinguish an action taken by an AI agent from one taken by a human. Sixty-eight percent. The agent does the work, and the log records a person. That is not a reporting gap. It is an accountability gap, and accountability is the whole game in a regulated workflow.

Most agents do not have an identity. They borrow one.

The reason the log names a human is that the agent is usually running as one. The same CSA research found agents living in what it calls an identity gray area: many run on shared service accounts, and a meaningful share operate directly under a real person’s login. A separate industry survey, Gravitee’s State of AI Agent Security 2026, put hard numbers on the same pattern. Only about a fifth of teams treat agents as independent, identity-bearing entities, and nearly half still rely on shared API keys for agent-to-agent authentication.

When an agent borrows an identity, it inherits that identity’s permissions, whether or not they fit the job it was built to do. That is the entire problem in one sentence. A borrowed identity is an action you cannot attribute and access you cannot scope.

The problem compounds, fast

Borrowed identity is not a contained issue. It multiplies. The CSA work found that agents routinely receive more access than they need and open new pathways that are hard to monitor, and that a large majority of practitioners worry prompt manipulation could push an agent into leaking the very credentials it holds. Then there is scale. KPMG’s 2026 cybersecurity report estimates non-human identities now outnumber humans by roughly eighty to one in the average enterprise. Every one of those is a credential someone has to govern, and an agent is happy to use any of them that happens to be lying around.

The cost of getting this wrong is already measurable. Netwrix’s 2026 report found that organizations where AI materially expanded the number of identities needing access reported breach rates close to four times higher than organizations where it did not.

This is already how breaches happen

None of this is theoretical. The 2026 Verizon Data Breach Investigations Report told readers plainly to pay special attention to service and machine accounts, because those are the credentials an agentic future will exploit. It is already underway. Third-party and token-based intrusions, the compromise of OAuth grants and machine credentials rather than passwords, are now a large and growing share of breaches. An autonomous agent that holds those same tokens, runs continuously, and never stops to ask whether something looks wrong is exactly the actor that turns a quiet credential into an incident.

How we set agent identity up in regulated origination

On our auto loan and credit card origination work, identity is not a setting we add once the pilot works. It is a day-one design artifact, on the same line as scope and the escalation path.

Every agent gets its own first-class identity. The intake agent is not the underwriting agent, and neither of them is a person. Each identity is scoped to exactly the steps that agent owns, and nothing more, so least privilege is enforced by design rather than promised in a policy document. Nothing is inherited from a human and nothing is shared between agents, because a shared credential is a broken audit trail waiting to happen. And every action an agent takes is logged under that agent’s own identity. When the intake agent validates an application, the trace says intake agent, not a service account, and not me.

That single discipline is what makes the system explainable to an examiner. In regulated lending, explainable to an examiner is the line between deployable and not. It is also what lets you answer the question this article opened with, instantly, for any action the platform ever took.

Identity is the control plane

The most useful framing I have seen this year comes from the security community, and it is worth repeating to anyone building agents: for autonomous systems, identity is the control plane. It is not paperwork you bolt on after the demo. It is the mechanism through which every other control, least privilege, monitoring, revocation, audit, actually attaches to the agent.

This connects directly to the thesis I keep coming back to. Intent in, outcomes out only holds if you can say, for every outcome, exactly which identity produced it. Strip that away and you do not have an accountable system. You have a fast, confident actor moving through your environment under someone else’s name.

So before you scale agents this year, ask one question ahead of all the others. When an agent acts, does your log show the agent, or a human it borrowed? If you cannot answer cleanly, identity is where your roadmap starts.

Dr. Harish Kotadia, Ph.D., is an Enterprise AI Architect with 20+ years of IT consulting experience serving Fortune 100 clients, specializing in agentic AI systems built on Anthropic Claude, AWS Bedrock, and Google Vertex AI. He holds a Ph.D. in Marketing Management with doctoral research in marketing analytics. Follow him at @agenticaiarch on X and at AgenticAIArch.com.