Six identity capabilities for securing autonomous AI agents

Autonomous AI agents are pushing security teams into awkward territory. They reason, call tools, run multi-step workflows and make decisions in real time, but they do it at machine speed and without a human watching every move. That breaks the old IAM split between people using MFA, SSO and interactive sessions, and workloads using static API keys or fixed tokens.

The New Stack’s argument is simple: if agents are going into production, identity has to become agent-aware. The piece says the goal is continuous Zero Trust governance built around the way agents actually behave, not the way traditional software used to behave. That means treating a delegated agent action less like a normal service call and more like a traceable event with a chain of responsibility.

The first two capabilities are about proving who or what the agent is, and limiting how long it can stay authenticated. The article calls for cryptographically signed agent identities tied to the model version, execution environment and deployment origin, plus an immutable delegation chain when a human hands off work or a primary agent spawns sub-agents. It also pushes just-in-time tokens, short-lived credentials, bound OAuth flows and PKCE instead of long-lived keys that hang around waiting to be stolen.

Then comes access control that understands intent. Traditional role-based access control is too broad for non-deterministic tool use, the piece argues, so teams need finer-grained policies based on relationships and attributes. In the example given, an agent can read a document only if a named human owns it and the active workflow is data summarization. The point is to check not just whether access is allowed, but whether the specific sub-task is allowed.

The last three capabilities move enforcement into the runtime. Security systems should watch for rapid parallel tool calls, loops and odd endpoint use, then trigger automated circuit breakers if behavior crosses a line. High-risk actions like code deployments or financial transactions should require human approval at execution time. And because these workflows can generate a lot of identity traffic, the underlying control plane has to handle token validation, policy checks, sub-agent teardown and cleanup without choking.

The old model assumed identity was mostly about login. Agents make identity part of execution, which is the part many teams still seem eager to hand-wave away until the first weird tool call lands in production.