Somewhere in your infrastructure right now, a piece of software is authenticating to another piece of software, using credentials nobody rotated, with permissions nobody scoped, owned by an employee who may have left the company. That was already true five years ago with service accounts. What changed in 2026 is that the software now decides things.
This week's article is about the least glamorous problem in agentic AI — identity — and why I think it's the one that determines whether enterprise agent adoption compounds or stalls.
Where we actually are
Start with the ratio. Palo Alto Networks' 2026 Identity Security Landscape report puts machine identities at 109 for every 1 human identity — up from 82:1 a year earlier. Of those 109, 79 are AI agents. Other vendors report different numbers depending on methodology — CyberArk says 80+:1, Entro found 144:1 in cloud-native environments, Veza just 17:1 — and that spread itself tells you something: nobody is measuring this the same way, which usually means nobody is governing it the same way either.
The governance data backs that up. Per the Cloud Security Alliance's work on non-human identity, only 15% of organizations feel highly confident in their ability to prevent NHI-based attacks, and more than 16% don't track the creation of AI-related identities at all. Meanwhile 98% of companies plan to deploy more agents in the next 12 months. Deployment is outrunning governance by a wide margin.
The industry noticed. At RSAC 2026, five major vendors shipped agent identity frameworks — Cisco (Duo Agentic Identity, registering agents as distinct identity objects mapped to human owners), Microsoft (Entra Agent ID), CrowdStrike, Palo Alto, and Cato, with Okta, SailPoint, and Silverfort close behind. On the standards side, the plumbing is being retrofitted in real time: an IETF draft extending OAuth 2.0 for agents acting on behalf of users, an Agent Authorization Profile for OAuth, and proposals composing WIMSE, SPIFFE, and OAuth into a coherent agent auth stack. The practical toolkit today is six OAuth-era capabilities pressed into new service: on-behalf-of delegation, token exchange, DPoP to bind tokens to keys, PKCE, CAEP for sub-second revocation, and attribute-based authorization.
Read that list again. Every item predates agentic AI. We are securing 2026's autonomy with 2012-2019's primitives. That's not an insult — it's how infrastructure always evolves — but it's worth being precise about: there is no purpose-built, widely adopted identity standard for AI agents today. There are drafts, vendor frameworks, and duct tape.
And the honest counterpoint, before I build anything on this thesis: identity is not where most agent failures happen today. OWASP's 2026 data shows prompt injection still drives the majority of agentic AI security failures in production. An agent with perfectly scoped credentials that gets its instructions rewritten by a malicious document is still a breach — the credential just makes the breach efficient. Anyone selling you agent identity as the whole answer is selling you a seatbelt for a car with no brakes. You need both.
The trajectory
Here's what I think the data supports, stated plainly.
Identity consolidates into the platform layer within ~24 months. The pattern rhymes with cloud IAM circa 2012-2015: chaos, then vendor frameworks, then de facto standards, then it becomes boring infrastructure. Five frameworks shipping in the same conference cycle is the "vendor framework" phase. The IETF drafts racing each other are the pre-standard phase. If the pattern holds, by 2028 "how do agents authenticate" is a solved, dull question — the way "how do pods get workload identity" became dull after SPIFFE.
The unsolved part is not authentication — it's the three gaps that survived RSAC. VentureBeat's analysis of all five frameworks found none of them solve: behavioral monitoring (what is the agent actually doing, versus what it's permitted to do), agent-to-agent verification (how one autonomous agent decides to trust another), and self-modification auditing (detecting when an agent changes its own instructions). Notice these are not identity problems in the classic sense. They're conduct problems. Identity answers "who is this?" — none of these frameworks answer "is it still doing what it was told?"
The limits of this extrapolation, explicitly: the ratio numbers are vendor-reported, from vendors who sell identity products, with methodologies that produce anything from 17:1 to 144:1 — treat the direction as solid and the magnitude as marketing. The IAM-history analogy assumes agents behave like workloads; they don't fully (workloads don't rewrite their own instructions). And standards races sometimes produce fragmentation instead of convergence — see the decade of container orchestration wars before Kubernetes won.
What if...
This section is speculation, clearly flagged as such. These may or may not happen. For each one I'll say what would need to be true.
What if agent-to-agent trust becomes its own PKI? Today, when my agent calls your agent, trust is inherited from the humans who configured them. If cross-organization agent transactions become normal — procurement agents negotiating with vendor agents, scheduling agents booking against other calendars' agents — inherited trust won't scale, and something like certificate authorities for agent conduct could emerge: attestation services that vouch not just for an agent's identity but for its behavioral envelope. What would need to be true: cross-org agent transactions become high-value enough that a failed trust decision costs real money, and someone (cloud providers are the obvious candidates) finds a business model in being the notary.
What if the forcing function is a breach, not a standard? CrowdStrike's CEO opened RSAC by disclosing incidents at Fortune 50 companies — including an agent that rewrote a security policy. The pattern in security regulation is consistent: SOX followed Enron, breach-notification laws followed TJX/Target-era incidents. A public, attributable, expensive agent-identity breach at a household-name company could compress the 24-month consolidation I predicted into 12, and bring compliance regimes with it — audit trails for agent actions as a regulatory requirement, not a best practice. What would need to be true: attribution. Today's forensics often can't cleanly separate "agent was compromised" from "agent was misused" — the self-modification auditing gap again.
What if identity turns out to be the wrong abstraction entirely? Everything above assumes we should treat agents like principals — give them IDs, scopes, tokens. A minority view: for entities that can be redirected through their context, identity theater doesn't help; what you actually need is intent attestation — continuous verification that current behavior matches declared purpose. If that view wins, today's agent-ID frameworks become a transitional layer, the way perimeter firewalls became transitional once zero-trust took hold. What would need to be true: behavioral baselining gets cheap and reliable enough to run inline, which today it is not — it's the first of the three unsolved gaps.
What I'm doing about it
I don't run a Fortune 50 SOC. I run something smaller and more instructive: a fleet of autonomous agents that operate my own systems daily — research, publishing, coordination — built in my lab as deliberate practice for exactly this question of how humans govern autonomous software.
The identity design decisions, learned by operating it, not by reading about it: every agent maps to one accountable human — me. No orphaned identities; if an agent misbehaves, there is never a question of whose problem it is. Scopes are minimal and asymmetric — agents that read are separated from agents that write, and the write-capable ones operate under explicit, documented autonomy grants that I can revoke in one place. Shared state lives in auditable files, not in agents' memories — every action is logged where I (or any other agent) can read it, which is my low-tech answer to the behavioral-monitoring gap: I can't yet verify intent inline, but I can always reconstruct conduct after the fact. And when an agent hits anything resembling an identity boundary — a CAPTCHA, a verification wall — the rule is absolute: it stops and hands control to the human. That's not a limitation I tolerate. It's the design.
None of that is sophisticated. That's the point. The three gaps RSAC left open are hard at enterprise scale, but the 80% version — named ownership, least privilege, append-only logs, human handoff at boundaries — is available to anyone deploying agents today. The organizations that will get hurt are not the ones with imperfect frameworks. They're the ones in that 16% that don't know how many agents they have.
The ratio is 109 to 1 and rising. Every one of those identities is a principal now. Start by counting yours.
Sources are linked inline. Next week: another field, same discipline — where we are, where the data points, and what might happen, honestly labeled.