Why agentic identities matter and what you need to know – Source: securityboulevard.com

We are entering the age of agentic AI — systems that don’t just assist but act. These agents can make decisions, carry out tasks, and adapt to changing contexts — autonomously. But with autonomy comes accountability. And the question becomes: who is acting?

To answer that, we need a new identity model built not for humans, but for artificial agents.

What is an agentic identity?

An agentic identity is a digitally verifiable identity assigned to an artificial agent — a bot, copilot, LLM function, or autonomous system — capable of acting on a delegated basis.

Unlike traditional service accounts or static credentials, agentic identities are:

• Ephemeral: Possibly spun up and destroyed in seconds.
  

• Delegated: Capable of acting on behalf of a user or another agent.
  

• Bound to context: Tied to a task, intent, and originator.

This is a fundamental shift from how identity has been handled for humans or even machine identities (what we call “non-human identities” or NHIs). NHIs are often long-lived and managed like infrastructure: think of a backend service with a static key in a key vault. Agentic identities, in contrast, are active actors in a runtime workflow.

How agentic identities differ from human and machine identities

Why enterprises need agentic identity capabilities now

The proliferation of LLM-based copilots, bots, and autonomous agents introduces both opportunity and risk. Consider:

• AI copilots in customer support systems that initiate refunds or escalate issues.
  
• Autonomous bots that rebalance cloud resources.
  
• Agents in financial workflows that suggest and execute trades.
  

In each of these cases, the agent must authenticate, be authorized, log its actions, and interoperate with human users, just like any employee would.

Without agentic identities:

• We see credential sprawl — agents sharing human tokens or keys.
• There’s no accountability — who initiated what?
• Auditing becomes impossible, and regulatory exposure grows.

A modern identity stack for agentic AI

At Strata, we’ve defined six critical identity functions — the “Six A’s” — that must be reimagined for agentic systems:

1. Authentication: Agents must prove their identity (via SPIFFE/SVID, JWT, PKCE).
2. Access Control: Agent actions must be scoped to allowable APIs or workflows.
3. Authorization: Support for OAuth On-Behalf-Of (OBO) and delegated policies.
4. Auditing: Every agent interaction needs traceable, signed records.
5. Administration: Agents must be registered, rotated, and expired — JIT provisioning is essential.
6. Availability: Identity must be continuous, even if the primary IDP is down.

Agentic identity requires all six — treating agents as first-class citizens in the enterprise identity fabric.

Seamless human-agent interoperation

A key principle in agentic identity is that humans and agents don’t live in separate identity domains. They must work together.

An AI copilot may initiate a purchase, but the final approval might come from a human supervisor. In that case, a shared session or chained authorization (OAuth OBO) must reflect the delegation clearly and be traceable in logs.

Just like in the case of a self-driving car — if something goes wrong, we ask: Was the system at fault? Or the human who set its objectives? The identity system must allow us to trace these chains of intent and execution.

Real-world examples

• Copilots in support centers: An LLM agent authenticates, inherits a session from the user, and logs every downstream action with contextual metadata.
• Ticket purchase bots: An agent acts on behalf of a human to buy tickets, first verifying age via an age-check agent using a zero-knowledge proof.
• Autonomous agents in finance: Agents operate under strict policy scopes and runtime checks, enforced by an MCP-aware proxy, preventing overreach or abuse.

Core capabilities in the agentic identity layer

Final thought: Agents are the new users

The security perimeter has shifted again — not from on-prem to cloud, but from users to agents. With estimates showing 80x more agents than human users in coming years, identity for agents is not optional — it’s urgent.

As AI continues to automate everything from IT to legal to finance, agentic identity becomes the foundation of safe, trustworthy autonomy.

Want to learn more? Sign Up for Early Access Program (link) Explore Maverics for Agentic AI and see how your enterprise can embrace the future of identity.