AI Agents Need Passports, Not Passwords
As companies hand more decisions to autonomous AI agents, the old rules about who gets access to what are breaking down. Here is what needs to change, and why it matters to everyone.
Key points
- AI agents, software programs that take actions and make decisions on their own without a human clicking each step, are moving faster than the identity controls designed to govern them.
- Five areas need new rules: how agents prove who they are, how they talk to each other, how they handle secrets like passwords, how much access they carry, and how they connect to human worker accounts.
- Static credentials, meaning fixed usernames and passwords that never change, are not safe for AI agents that touch dozens of systems in seconds.
- The principle of least privilege, giving any account only the minimum access needed for one specific job, becomes more urgent as agents hand tasks to other agents down a chain.
- Every action an AI agent takes should be traceable back to a human being who approved it.
Companies are deploying AI agents to book meetings, process invoices, query databases, and draft contracts. These are not chatbots waiting for a question. They act. They log into systems, pull data, and trigger other processes, sometimes handing work to a second or third agent before a human sees the result.
The security controls built for human employees were never designed for this.
That gap is the subject of a detailed piece from CSO Online, which maps out five areas where today's identity management, the whole system of deciding who can access what, falls short for agentic AI.
How do you even know which AI agent is which?
Right now, nobody fully agrees. Some organisations treat AI agents like service accounts, the faceless machine logins that software uses to connect to databases. Others argue agents deserve their own category entirely. What is clear is that each agent needs something like a digital passport: a verifiable credential that can be recognised, tracked, and cancelled across cloud systems, on-site servers, and third-party software.
Without that, there is no way to know which agent did what, or whether a rogue process snuck in pretending to be a trusted one.
The secrets problem is equally sharp. Traditionally, passwords and API keys (the private codes that let one piece of software talk to another) are handed out by an IT team and sit in a vault until needed. That is too slow and too static for agents that spin up and complete a task in milliseconds. The smarter approach works like a modern hotel key card: issued for one stay, useless the moment you check out. Generate a credential, use it once, retire it.
Access creep is another quiet danger. An agent might start a workflow with the same permissions as a senior analyst, because it needs that analyst's context. But if it hands the task to a sub-agent, and that agent hands it to another, those broad permissions should not travel the whole chain. Each handoff should trim the access down until only the bare minimum needed for the next step remains.
For ordinary people, the practical concern is this: if your employer, bank, or hospital uses AI agents to process your data, you have a legitimate interest in whether those agents are properly identified and limited. Ask whether the organisation can show an audit trail, a log of every action an agent took and what permission authorised it.
If they cannot, the agents are running loose.
MFA, multi-factor authentication (where you confirm your identity through two separate checks, like a password plus a code to your phone), would not directly solve most of these agent-level problems. The challenge here sits a layer below individual logins. It lives in the architecture itself.
