Summary
- AI agent identity strategies are moving beyond the use of human credentials.
- Separate agent identities leave unresolved questions about permissions, scope, and expiry.
- Accountability and time-limited access remain central to safe autonomous operation.
There’s been a lot of focus on AI agent identity recently. With announcements from Anthropic, WorkOS, 1Password, and Claude Enterprise, all pointing towards the industry finally solving the agent identity problem, it feels like progress is finally being made. But what seems to be being overlooked is that it’s still only addressing part of the problem. The other part revolves around access.
The problem with pretending agents are people
Anyone who has worked with AI will understand the problems that come from making software behave like a human. It’s something I’ve encountered many times but the first instance, when integrating a new platform for a client, particularly stands out. Because of the way the platform worked, our AI agent had to take on a human identity. And it worked but then a browser extension confused it with an unexpected element, and the process failed. The same thing happened when a password manager encountered an unexpected login prompt.
A credential broker eventually solved these problems, and made the setup considerably more secure in the process. But the fact remained that the agent was still borrowing a human identity. And that caused problems of its own.
This is what the recent announcements are seeking to resolve.
Alternative approaches
So far, there have been a couple of different approaches to this problem.
Okta and 1Password are extending existing identity infrastructure to include AI agents. It’s probably the most straightforward approach, because enterprises already have the relevant infrastructure, so it just means adapting that foundation for AI. But the drawback here is that the agent will still be operating through a human identity, which takes us back to some of the original problems.
WorkOS and Anthropic’s approach is different. Rather than making the agent look like a person, the agent gets an identity of its own. And that feels like a more important change of tack. But it does introduce another question that can’t be ignored: what that identity should actually be allowed to access.
Identity isn’t the same as permission
Giving an AI agent its own identity doesn’t automatically make it safe. It can make good sense, in some cases, to give an agent broad access. If it’s working inside a shared team, it may need access to a range of information and systems to make it genuinely useful. To make this viable, Claude Tag uses its own identity and service accounts, so AI agents don’t need access to individual user credentials. Anthropic takes a similar approach, with the aim of making AI agents as useful as possible. But that raises questions about security.
If an agent only needs access to one system to complete one task, why should it retain access to ten? If it is working on behalf of a team for an hour, why should its permissions remain valid indefinitely? A more restrictive model would give an agent only the permissions it needs for the task in front of it, potentially creating a new identity for each task. It’s harder to implement, but it provides the safety net so clearly lacking from the other approaches.
The accountability question
There is also another complication here: responsibility. Traditional security models are generally designed around people, creating a clear audit trail of accountability. AI agents complicate that. If an agent has its own identity, who is responsible for its actions when things go wrong? None of this is insurmountable, but it highlights why agent identity is only one part of a bigger problem.
In recent months, the industry has made real progress in moving agents away from borrowed human credentials. It’s an important development that could probably have done with being addressed sooner. But it doesn’t solve every problem. Deciding how much access and authority an agent should have, how long it should have it, and how we maintain a clear line of accountability when it acts autonomously needs more thought.
Asking ‘Who is this agent?’ is no longer enough. Instead, we now need to be asking, ‘What can it do, and who is responsible when it does it?’ Until we can answer both, the agent identity problem isn’t solved.
