Agent Identity Governance

Definition

Agent identity governance is the lifecycle discipline for discovering AI and other non-human identities, attributing ownership, granting scoped access, monitoring use, certifying continued need, and revoking authority when it is no longer justified.

Current Synthesis

Agent identity is more than authentication. A valid credential can still be orphaned, overprivileged, stale, or attached to no accountable person. The current source therefore joins technical identity to ownership and lifecycle review: organizations first need visibility into agents, bots, service identities, and endpoints, then a responsible owner, contextual entitlements, activity records, periodic certification, and reliable revocation. This makes access legible without making probabilistic agent behavior predictable.

Key Claims

• Every consequential agent needs a distinct, attributable identity rather than borrowed or anonymous credentials.
• Discovery must include non-human accounts and endpoints that ordinary employee lifecycle processes can miss.
• Owner assignment creates a review and escalation anchor but does not prove practical control over emergent behavior.
• Governance covers provisioning, monitoring, certification, narrowing, and revocation, not only initial authentication.
• Orphaned, stale, or excessive machine authority expands attack surface and weakens accountability.

Evidence

• Discovery and ownership - Who Is Responsible When AI Agents Make Decisions | Matt Mills x Shekhar Natarajan presents Entro and SailPoint as discovering, categorizing, and assigning owners to non-human identities.
• Lifecycle control - Who Is Responsible When AI Agents Make Decisions | Matt Mills x Shekhar Natarajan describes access provisioning, monitoring, periodic certification, and immediate removal when authority should end.
• Control boundary - Who Is Responsible When AI Agents Make Decisions | Matt Mills x Shekhar Natarajan explicitly separates governance of access from the quality and predictability of AI output.

Counterevidence & Qualifications

The source provides a vendor architecture rather than measured discovery coverage or breach reduction. Human ownership can become nominal when one person oversees too many agents, lacks technical visibility, or cannot interrupt action. Shared infrastructure, spawned agents, inherited credentials, and multi-party model stacks can also make one-to-one attribution misleading.

What Changed

• Established lifecycle governance for agent and machine identities as distinct from authentication alone.
• Added orphaned identity and nominal-owner failure modes.

Related Concepts

• Agent Identity And Authentication - supplies the technical identity and authentication prerequisite.
• Enterprise Agent Governance - embeds identity lifecycle inside broader production controls.
• Agent Permission Boundaries - limits what a governed identity may do.
• Contextual Agent Authorization - evaluates whether a specific action should be allowed now.
• Human Accountability For AI Agents - tests whether formal ownership creates meaningful responsibility.