Clarion Street

Your Agents Are Your Newest Unmanaged Identities

·9 min read

Every agent you deploy is a de facto identity, and almost nobody is treating it that way. The access-control problem that agents create, the way a model deciding its own tool calls at runtime breaks a fixed permission set, is real and I have written about it in Certifying the Loop. But that is a symptom. The prior question is stranger and simpler: an agent is itself a new kind of identity, and the machinery we use to govern identities does not yet have a word for it.

This is not a hypothetical. Microsoft counted 230,000 organizations, including 90% of the Fortune 500, that had built agents or automations in Copilot Studio, and 15 million developers using GitHub Copilot [2]. One forecast puts the agent market at $7.8 billion in 2025, on its way to $52.6 billion by 2030 [4]. Not every agent in that count holds credentials; plenty are prototypes that never touch a protected system. But an agent that reads a database, writes to a repository, or calls a paid API has to authenticate to something, and each of those authentications is a credential. Those are the agents this post is about.

The numbers are already large

Non-human identities, NHIs in the security literature, are the accounts that are not people. Service accounts, API keys, OAuth tokens, machine certificates, and now the credentials AI agents hold. They outnumber human users by roughly 45 to 1 on average, and by up to 144 to 1 in cloud-native environments, up from 92 to 1 a year earlier [11]. In one audited Fortune 500 financial institution, there were 4.2 million NHIs against about 50,000 human accounts [11]. The whole population grew 44% between 2024 and 2025, and AI-related secrets are the fastest-growing credential category, up 81% year over year [11].

Those figures are industry estimates, not census data. The ratios, the growth, and the AI-secrets jump come from Entro Labs and GitGuardian by way of the Cloud Security Alliance’s May 2026 whitepaper [11]. Palo Alto Networks has put the machines-to-humans ratio at 82 to 1 in its coverage of the OWASP list [15], and at 109 to 1 in its 2026 Identity Security Landscape report, which the old CyberArk press-release URL now resolves to [16]. The exact number depends on who is counting. The direction does not.

OWASP’s working definition is the one worth keeping. NHIs are “applications, workloads, APIs, bots, and automated systems” that are “not controlled and often not intrinsically tied to a human” [6]. Agents now sit in that class, and the canonical incidents are already on record. Midnight Blizzard’s attack on Microsoft moved through a legacy OAuth application the company described as an unmanaged non-human identity [6]. Okta’s breach started with a compromised service account [6]. Neither was exotic. Both were machine credentials nobody was watching. An entire open-source ecosystem of agent frameworks now ships these agents [3], and the security community has stood up OWASP’s Agentic Security Initiative to standardize the threat model [9].

A service account is a noun. An agent is a verb.

R Street defines an agent as “an autonomous intelligent system powered by AI and designed to perform specific tasks independently without the need for human intervention” [1]. The reason agents strain IAM more than the earlier wave of NHIs is that a service account is static. Someone mints it with a fixed set of permissions, and its blast radius is decided at issuance. An agent is not like that. The Cloud Security Alliance puts it plainly: an agent “acquires permissions dynamically at runtime, spawns sub-agents, invokes external APIs, writes and executes code” [11]. Its blast radius is not set when the credential is created. It expands as the agent operates.

That is the specific reason the standard playbook fails. MFA, privileged access management, quarterly access reviews, SIEM tuned to human behavior, all of it was built for people who hold a stable job and a stable permission set. Only 15% of organizations say they are highly confident they can prevent an NHI-based attack, and more than 16% do not track the creation of AI-related identities at all [11]. The identity layer simply has no concept of what an agent is, and that is a bigger hole than any amount of key management would fill.

The protocol people have been circling this for a while. I covered the MCP roadmap’s turn toward “agent identity and enterprise-ready security” in MCP Goes Stateless, and the accountability hole at the center of Cloudflare Wallets, where an agent is attributed to an account rather than a person. Both are the same argument seen from two angles: an agent needs an identity object, and that object has to carry a trace of who is accountable for it.

What a vendor answer looks like

Microsoft’s Entra Agent ID is the clearest attempt to ship that object. It makes an agent a first-class identity, a special service principal, rather than a bundle of long-lived keys. The agent identity “doesn’t have credentials on its own” [10]. The credential lives on something Microsoft calls an agent identity blueprint, a reusable template that also lets an admin do several things at once: apply a conditional access policy to every agent of a kind, disable all of them, revoke a permission grant across all of them, and record a human sponsor who is accountable for the agent [10].

The sponsor is the part worth noticing. For the first time in the identity stack there is a slot for “which person answers for this machine” [10]. That is the exact hole Cloudflare’s wallet identity left open, and it is the piece most IAM products skip. Whether a sponsor actually answers for anything in practice is a different question, and nothing in the material demonstrates enforcement. But the design at least names the missing field.

Two catalogs, one gap

OWASP has written two Top 10 lists that map the problem from opposite ends. The Non-Human Identities Top 10 (2025) covers the machine-credential layer: Improper Offboarding, Secret Leakage, Overprivileged NHI, Insecure Authentication, Long-Lived Secrets, NHI Reuse, and Human Use of NHI, among others [5]. That last one, NHI10, is the sharpest. It flags “lack of auditing and accountability due to indistinguishable activity between humans and automation” [5]. When an analyst logs in with a shared service account, or a person uses an API key by hand, the audit trail cannot tell you who did what. The intent-versus-action gap in one sentence.

The Top 10 for Agentic Applications (2026) adds the agent-specific view. “Identity & Privilege Abuse” sits at number three, covering cached credentials, delegation chains, and “ambiguous identity contexts [that] blur accountability” [8][14]. “Tool Misuse & Exploitation” sits just above it, an agent misusing tools it already has rather than breaking into new ones [8][14]. OWASP’s companion “Agentic AI — Threats and Mitigations” resource formalizes the same threat model for practitioners [7].

Together the two lists name the genuine, unresolved tension in the whole project. An agent that has to discover tools to do its job is, by construction, hard to lock to a fixed permission set. Least privilege wants the narrowest possible grant. Discovery wants the widest possible menu. Tool Misuse flags the collision from the agent side [8], and the Excessive Agency problem I covered in Certifying the Loop is the same tension from the permission side. Neither catalog resolves it, and I am not going to pretend there is a settled answer.

The regulator has not caught up

The part I keep coming back to is how far the standards have run ahead of the regulation. In the sectors where this matters most, the governing text is CMMC 2.0, the final rule published October 15, 2024 and effective December 16, 2024, which aligns defense-contractor baseline controls with NIST SP 800-171 across three levels [12]. Its relevant control families, Access Control and Identification and Authentication, speak of “accounts,” “devices,” and “processes acting on behalf of users” [12][13]. They do not use the term “non-human identity,” and they do not name “agent” at all.

A version note, because this detail trips people up. The CMMC final rule’s text references NIST SP 800-171 Rev 2, and NIST has since withdrawn Rev 2 and superseded it with Rev 3 [13]. I am deliberately not pinning a revision number to CMMC here because the alignment is genuinely messy. What matters for this argument is that the text the final rule references, Rev 2, has no category for what an agent is. Neither the final rule nor Rev 2 uses the term “non-human identity.”

So the situation is inverted from how compliance usually works. Normally the regulator writes the requirement and the vendors scramble to meet it. Here the fastest-growing credential category is AI-related secrets [11], and the agent itself is not in the control catalog at all [12][13]. The overlay is being written by OWASP and the Cloud Security Alliance, not by the regulator. The CSA whitepaper calls it a governance vacuum and points at “compliance and regulatory blind spots” that leave organizations exposed [11]. That is accurate. It is also a polite way of saying the audit you passed does not know your agents exist.

Bottom line

The answer is not a bigger key vault. It is an identity with zero standing privilege, a human sponsor attached to it, and an audit trail that is the trace of what the agent actually did rather than a point-in-time snapshot [11]. Entra Agent ID is the identity object [10]. OWASP’s two catalogs are the threat model [5][8]. The missing piece, still, is a regulator that can name the thing being governed.

I want to be honest about where each of those pieces stands. The vendor claims are product features, not assessor-accepted controls [10]. The trace-as-audit-artifact idea is a direction, not a procedure anyone has signed off on. The numbers are vendor estimates [11][15][16]. The intent-versus-action gap NHI10 names is still an open problem [5]. CMMC 2.0 does not require any of this, and nothing here should be read as a compliance obligation [12]. It is a description of where the identity perimeter will break first, and who is writing the rules until the regulator does. Right now that is OWASP and Microsoft.

Sources

  1. The Rise of AI Agents: Anticipating Cybersecurity Opportunities, Risks, and the Next Frontier — R Street, Policy Study No. 325 (May 2025)
  2. Microsoft Build 2025: The age of AI agents — Microsoft Blog
  3. Agentic Open Source Companies List — potpie-ai/AI-COSS, GitHub
  4. Best open source agent frameworks 2026 — Firecrawl
  5. OWASP Top 10 Non-Human Identities Risks (2025) — OWASP
  6. OWASP Non-Human Identities Top 10 2025 — Introduction — OWASP (definition and incident examples)
  7. Agentic AI — Threats and Mitigations — OWASP
  8. OWASP Top 10 for Agentic Applications (2026) — OWASP
  9. OWASP Agentic Security Initiative — OWASP
  10. Agent identities in Microsoft Entra Agent ID — Microsoft Learn
  11. The Non-Human Identity Governance Vacuum — Cloud Security Alliance (May 2026)
  12. Cybersecurity Maturity Model Certification (CMMC) Program Final Rule, 32 CFR 170 — Federal Register (Oct 2024)
  13. NIST SP 800-171 Rev. 2 — NIST (withdrawn, superseded by Rev 3)
  14. OWASP Top 10 for Agentic Applications 2026 explained — Teleport
  15. OWASP Top 10 for Agentic Applications 2026 — Palo Alto Networks
  16. 2026 Identity Security Landscape (Idira) — CyberArk / Palo Alto Networks (press-release URL now resolves to the Idira platform page)