You're facing a new challenge: how do you apply zero trust controls to entities that actively work to evade them?
This isn't a theoretical issue. 80% of agents in your environment aren't registered. They're creating subagents, communicating in ways you can't intercept, and turning authorized actions into unauthorized outcomes. Your identity governance model assumes static, accountable entities. Agentic AI gives you shape-shifters.
Here's how to choose your path forward.
The Decision You're Facing
Do you extend your existing identity controls to cover AI agents, build a parallel governance layer specifically for non-human identities, or accept that traditional identity-based enforcement won't work and shift to outcome monitoring?
This isn't about tweaking policies. It's about whether your fundamental control point, identity verification, still applies when the entity can change materially between Monday's approval and Friday's execution.
Key Factors That Affect Your Choice
Agent registration rate in your environment. If most agents are registered and onboarded through IT, extending identity controls is feasible. If only 20% are registered, you're governing a compliant minority while the majority operates in shadow IT.
Visibility into agent communications. Can you see what agents tell each other? Current tools detect that communication happened, not what was said. If you can't pierce agent-to-agent interactions, identity-based controls miss the attack vector.
Reversibility of agent actions. Agents that write reports or generate summaries create different risks than those that transfer funds or modify IAM policies. Reversible decisions tolerate more autonomy than those with irreversible consequences.
Your threat model. Are you defending against accidental exfiltration or targeted state actor campaigns? Sophisticated attackers split malicious instructions across multiple agents, keeping each within its authorized behavior profile while the aggregate achieves an unauthorized goal.
Path A: Extend Identity Controls to Non-Human Identities
Choose this when your agent population is mostly registered, you have strong onboarding processes, and agents perform bounded, auditable tasks.
Implementation requirements:
Require every agent to carry a cryptographically signed credential with explicit scope. An agent authorized to read customer records shouldn't inherit write access to external APIs just because it shares a service account.
Implement short-lived subkeys for any agent that spawns subagents. The parent agent retains a protected primary identity; subagents get time-limited credentials with narrower scope. When the subkey expires, the subagent's authority expires with it.
Set transaction boundaries and rate limits at the identity level. An agent allowed to query a database 100 times per hour can't suddenly make 10,000 queries without triggering a control failure, even if each individual query is authorized.
This path fails when:
Agents update their models, add tools, or accumulate context without touching their identity records. You approved one machine on Monday; a materially different machine is wearing that badge by Friday. Your allowlist says "approved" but the entity has changed.
Agent-to-agent communication becomes your blind spot. You can verify the identity of both parties, but you can't see if Agent A is instructing Agent B to exfiltrate data in five authorized steps.
Path B: Build Parallel Governance for Autonomous Systems
Choose this when your environment has significant shadow AI, you can't register every agent, and you need to govern behavior rather than identity.
Implementation requirements:
Shift your control point from "who is making the request" to "what sequence is being assembled." Monitor for patterns where five individually authorized actions combine into data exfiltration, privilege escalation, or policy modification.
Deploy sandboxing and approval gates for high-consequence actions. Let agents operate autonomously for reversible decisions (generate a report, summarize findings, query a dataset). Require human approval for irreversible decisions (delete production data, change IAM policy, initiate financial transfers).
Create immutable activity trails that capture not just what the agent did, but what authority it was carrying and what context it had accumulated. Traditional audit logs show "Agent X read file Y." You need logs that show "Agent X, with model version 2.3, carrying context from three prior queries, read file Y after being instructed by Agent Z."
Implement spend and data budgets at the behavioral layer. An agent can read up to 10GB of customer data per day, regardless of how many subagents it spawns or which identities it uses.
This path fails when:
Attackers learn what victim agents are authorized to do and craft instructions that keep each agent within its legitimate behavior profile. Your behavioral monitoring sees normal activity. The malicious outcome emerges from the aggregate.
You're collecting massive telemetry without the analytical capacity to find meaningful patterns. You're throwing more hay on the haystack.
Path C: Assume Identity Is Inadequate
Choose this when you're defending against sophisticated threats, agents routinely modify themselves, and you need defense-in-depth beyond identity verification.
Implementation requirements:
Treat identity as one signal among many, not your primary control point. An agent with valid credentials still gets evaluated on: What has this identity become? What sequence is it assembling? Does the receiving system agree the authority is valid?
Build quick, confident undo mechanisms for every agent action. If you can't prevent a bad decision, you need to reverse it within minutes. Immutable append-only logs, snapshot-based rollback, and automated remediation workflows become your real controls.
Implement cryptographic delegation chains that make authority visible and verifiable. When Agent A delegates to Agent B, that delegation is signed, scoped, and time-limited. Any system receiving a request from Agent B can verify the full chain back to the original authorization.
Accept that you won't govern the "compliant minority" of registered agents and instead focus on containing blast radius. Segment your environment so a compromised agent in marketing can't pivot to financial systems, regardless of what identity it's carrying.
This path fails when:
Your organization measures security on "everything that happens when it goes wrong" while the business measures agents on productivity gains. You're looking at the same entities through incompatible balance sheets, and you lose the budget argument.
Summary Matrix
| Approach | Best For | Primary Control | Fails When |
|---|---|---|---|
| Extend Identity Controls | Registered agents, bounded tasks, reversible decisions | Cryptographic credentials, transaction limits, short-lived subkeys | Agents change materially without touching identity; agent-to-agent communication bypasses verification |
| Parallel Governance | Shadow AI environments, behavior-focused defense | Sequence monitoring, approval gates, behavioral budgets | Attackers stay within individual agent profiles; telemetry volume exceeds analytical capacity |
| Assume Identity Inadequate | Sophisticated threats, self-modifying agents, irreversible decisions | Delegation chains, undo mechanisms, blast radius containment | Budget constraints; business priorities conflict with security controls |
The harder truth: zero trust was designed to evaluate requests one at a time. Agents assemble sequences. An agent can walk through five perfectly legal doors and end up somewhere you never authorized. Your governance model aimed at the wrong layer.
Pick the path that matches your threat model and your actual agent population, not the one your policy documents claim you have.
