Recent events, including Anthropic’s introduction of Claude Mythos, have caused enterprises to reassess the evolving threat vector of non-human identities and AI agents. Both non-human identities (NHIs) and AI agents pose unique identity and access management challenges:
Volume and proliferation: The Identity Security Landscape report estimates that non-human identities (NHIs) outnumber human users by roughly 109:1 today with that gap expected to nearly double in the coming year.
Ephemerality: Unlike traditional human identities, NHIs and AI agents spinning up and down in a matter of minutes pose issues for traditional access controls and access reviews.
Privileged by design: NHIs and AI agents are provisioned with the broad access needed to reason and act on behalf of humans, and they increasingly interact with other agents in delegation chains that no traditional lifecycle model was ever built to govern.
Scale of governance: NHIs and agents increasingly interact with other agents in delegation chains that no traditional lifecycle model was ever built to govern.
Organizations are already exposed to enterprise risk today. A survey of nearly 3,000 identity professionals found that nearly all companies are leveraging agentic AI in production, but only 15 percent of organizations consider NHIs and AI agents to be privileged identities.
Using SailPoint to govern AI and NHI identities
SailPoint, a leader in the identity and access governance space, has historically aided customers in providing visibility and control to their human identities through identity and account correlation, entitlement aggregation, role-based access controls and policy enforcement. Now, SailPoint is taking proactive steps to expand how its governance model can support organizations navigate the complexities posed by NHIs and AI agents.
Discovery and classification
By establishing SailPoint as the NHI and AI agent control plane and deploying auto-discovery capabilities across cloud platforms and AI vendors, enterprises are taking the first steps to addressing issues of volume, proliferation and ephemerality.
-
- Using tools like machine identity security and agent identity security, companies can integrate SailPoint with source systems including cloud platforms to discover NHIs and agents.
- Enterprises can develop classification rules to categorize each identity and map discovered identities to corresponding machine, application or human identities for ownership.
Governance and lifecycle management
Once ownership is assigned, owners will be responsible for ensuring identity attributes are populated and accurate. Owners will also oversee lifecycle management activities, including provisioning, deprovisioning and modification of NHIs and agents as their roles or purposes evolve. Appropriate controls can then be applied to NHIs and AI agents that are commensurate with their state as privileged accounts, such as conducting periodic certifications which can be scheduled or triggered based on a specified event.
Auditability
Admins can track, review and manage AI agent identities and their associated accounts and usage. Having a single control plan for human, non-human, bot and AI agent identities significantly reduces administrative burden and can ensure consistency across the organization.
Our recommendations
Identify key NHI and AI stakeholders across the organization who are responsible for governance including information security, identity and access management, data governance and AI governance teams. Collaborate with key stakeholders to develop or enhance AI governance framework and map to technology capabilities. Key focus areas should include:
- Defining an NHI and agent intake process and configuring mapping rules to triage discovered identities and accounts.
- Establishing SailPoint ISC as the designated agent inventory and control plane.
- Creating an NHI/AI agent inventory process and leveraging tools including SailPoint ISC to discover new NHIs or agents created outside of the intake process.
- Developing a plan to integrate ISC with necessary downstream and upstream technologies, including cloud platforms for discovery.
- Working with technical stakeholders to define mapping rules.
- Developing remediation processes to ensure discovered NHIs and AI agents have appropriate attributes documented and controls applied which may include leveraging ISC to automate review campaigns on NHIs and AI Agents.
- Defining additional controls including data restrictions, credential controls, and runtime authentication and authorization controls to be applied to NHIs and agents.
After defining a strategy and approach, focus on maturing and operationalizing controls. Future areas of consideration include runtime authentication and authorization. As technologies evolve, organizations must continue to update their NHI and AI agent controls models to protect against emerging threats.
To learn more about our SailPoint consulting services, contact us.
