AI Agent Security Is an Identity Problem

May brought an overdue correction to the AI conversation. The central security question was no longer only whether a model might produce a bad answer. It was what could happen when an agent with a real identity, stored memory, tool access, and delegated authority encountered a malicious instruction or simply made the wrong decision.

Traditional cybersecurity has spent decades establishing who or what is requesting access, what it is allowed to do, and how the action will be recorded. Agentic systems do not invalidate those principles. They make them urgent.

An agent should never inherit the user's entire authority

NIST's National Cybersecurity Center of Excellence published a concept paper on software and AI agent identity and authorization. Its premise is exactly right: an agent needs a distinguishable identity and policy appropriate to the work it performs. Borrowing a human token creates excessive privilege and weak accountability.

The NIST AI Risk Management Framework provides a broader structure for governing, mapping, measuring, and managing risk. OWASP's GenAI Security Project translates emerging threats such as prompt injection, tool misuse, excessive agency, and memory poisoning into practical engineering concerns.

Security is what makes scale possible

Without these controls, every new integration expands blast radius. With them, organizations can assign agents useful work while keeping failure contained. A support agent may read a customer record but need approval to issue a refund. A development agent may open a pull request but never deploy to production. A marketing agent may draft and segment but remain unable to export an entire customer database.

OpenAI's discussion of link safety for agents demonstrates one defense against data exfiltration through manipulated URLs. MITRE's ATLAS knowledge base helps teams think about adversarial tactics against AI-enabled systems. The use of agents will grow, but regulated and high-consequence environments will demand evidence that authority is constrained.

A practical control plan

Inventory every agent and assign an owner. Give each a service identity. Deny access by default. Separate development, evaluation, and production. Test with adversarial inputs. Require confirmation for financial, destructive, external, or privilege-changing actions. Log tool calls with enough context for investigation. Establish a kill switch and rehearse it.

Most importantly, measure the system after launch. Autonomy should expand only as evidence accumulates. Trust is not a launch setting. It is an operational record.

Continue through the connected ecosystem: Read why the conventional agency model is giving way to connected AI systems, explore why systems beat campaigns, and see how AI can improve marketing ROI.

Sources and further reading

• NCCoE: software and AI agent identity and authorization
• NIST AI Risk Management Framework
• OWASP GenAI Security Project
• OpenAI: AI agent link safety
• MITRE ATLAS