Home › Guides › AI Agent Identity
Tech Explained · 2026What Is AI Agent Identity in 2026? How Non-Human Identity Works, Agent Identity vs Service Accounts and 6 Steps to Govern It
AI agent identity gives every agent its own credential, its own permission scope and its own audit trail, instead of letting it borrow a human login or a shared service account. Google issues SPIFFE-format agent IDs, Microsoft issues Entra Agent ID. Palo Alto Networks puts machine identities at 109 to 1 against humans.
- The agent becomes the principal. It holds its own identifier, so every log entry and every denial points at the agent rather than at a person who was asleep.
- Shared service accounts are the thing being replaced. One key across nine agents means you cannot revoke one without breaking eight.
- Three vendors already ship it. Google's docs describe a SPIFFE-formatted Agent Identity, Microsoft bundles Entra Agent ID into Agent 365, and IBM shipped Agent Identity with HashiCorp Vault 2.2.
- You are rarely billed per agent. Third-party Microsoft licensing guides list Agent 365 at $15 per user per month with Entra Agent ID folded in, so cost tracks seats, not agent count.
- OAuth 2.1 is the floor, not the answer. The MCP specification's HTTP transport moved to it in January 2026, making PKCE mandatory, but a valid token still does not authorise a specific action.
- Ownership beats tooling. The agent with no named sponsor is the one still holding a write scope eight months after its pilot ended.
- Career read: this lands on platform, cloud and forward deployed engineers, not on the security team alone.
Your claims-triage agent has run for six weeks and nobody can tell you what it is allowed to do. It authenticates with a client secret a contractor pasted into a pipeline variable in August, it reads two databases and one mailbox, and every action it takes is logged against a senior analyst who left in September. Nothing is broken. That is the problem: no alert fires, and you cannot answer the one question an auditor will ask, which is who did this.
What AI agent identity actually is
AI agent identity means treating the agent as its own security principal. It holds a credential that belongs to it, carries permissions assigned to it, and leaves log entries under its own name. When it calls a tool, the system knows three things: which agent this is, which human it is acting for, and which scope it has for this one call.
That third thing is where teams are weakest. Authentication answers who the agent is. It does not answer whether this agent may send email at 2am for a user who is asleep.
The number that is driving every vendor roadmap
Identity volume stopped being a human problem some time ago.
Machine identities per human identity, in Palo Alto Networks' 2026 identity security survey of 2,930 cybersecurity leaders, up from 82 to 1 the year before; the same survey projects AI agent identities growing fastest of the three categories it tracks.
Figure from Palo Alto Networks' own published survey, checked 27 October 2026. Vendor-run surveys define "machine identity" differently, so treat the ratio as directional.
Why the old pattern stops working
For twenty years the answer to "how does this automation authenticate" was a service account, and it worked because automations were few and predictable. A nightly ETL job does the same four things forever. An agent decides what to call next, and the tools it can reach are the ones you handed it on day one, which is always wider than what it needs today.
Agents also multiply quietly. You build one, somebody forks it for a second use case, and the fork inherits the same secret. Six weeks later you have nine agents on one credential.
How AI agent identity works: tokens, SPIFFE IDs and per-call scopes
The mechanics are less exotic than the marketing suggests. Three layers, three different jobs.
Layer one, workload identity. The agent proves what it is cryptographically, without a static secret. SPIFFE is the standard: the platform attests the running workload and issues a short-lived certificate called an SVID. Google's Gemini Enterprise Agent Platform documentation describes Agent Identity as a unique SPIFFE-formatted ID and positions it as a granular alternative to shared service accounts, with permissions assignable straight to the agent on a Cloud Storage bucket or a BigQuery dataset.
Layer two, delegation. The agent must act for a user without becoming that user. In January 2026 the Model Context Protocol specification's HTTP transport adopted OAuth 2.1 for exactly this: PKCE mandatory, the implicit and password grants gone, redirect handling stricter. Autonomous agents use the client credentials grant; user-delegated work uses an on-behalf-of exchange. RFC 8693 token exchange is the plumbing that turns a workload identity into a scoped, short-lived token for one resource.
Layer three, authorization per call. A valid token says the agent holds claims.read. It does not say the agent may read this customer's claim right now. That decision belongs at the tool boundary, every time, and it is the layer every vendor is weakest on.
One tool call, with the agent as the principal
Notice where the deny happens and whose name ends up in the log.
Flow assembled from Google's Agent Identity documentation, the MCP OAuth 2.1 authorization specification and RFC 8693, checked 27 October 2026.
Wiring this sequence, with a real token exchange and a real deny path, is one of the deployment patterns practised live in 360DT's Forward Deployed Engineer course, because it is what breaks first when an agent pilot meets a security review.
Also read: How OAuth 2.0 Works: The Authorization Code Flow, PKCE and Token Validation Explained for 2026.
Agent identity vs service accounts: what actually changes
Three patterns are in play, and the third column is what most teams already have.
| Criterion | Dedicated agent identity | Shared service account | Agent using a human's token |
|---|---|---|---|
| Who the log blames | The agent, by name | The service account, shared by all agents | The human, who did not do it |
| Credential type | Attested, short-lived (SVID, exchanged token) | Static client secret or key | Borrowed refresh token |
| Revoking one agent | Delete that identity, nothing else moves | Breaks every agent on the key | Locks out a real employee |
| Permission precision | Per-agent, per-resource, per-call | Union of everything any agent ever needed | Everything that human can reach |
| Behaviour when the human leaves | Unaffected | Unaffected | Agent silently dies, or worse, keeps working |
| Secret rotation effort | Automatic, tied to workload attestation | Manual, and everyone is scared to touch it | Not applicable, and that is the problem |
| Blast radius of a prompt injection | The agent's own narrow scope | Every scope on the shared account | The human's full access, including HR and payroll |
| Fits a DPDP or EU AI Act audit | Yes, attributable and reversible | Partially, you can prove what but not who | No, attribution is simply wrong |
| Lifecycle owner | Named sponsor on the identity object | Usually nobody | A person who does not know they own it |
| Setup cost on day one | Highest: policy, registry, sponsor, deploy wiring | Near zero | Zero, which is why it happens |
Read the last row honestly. Dedicated identity costs the most to set up, which is why borrowed tokens keep winning in week one. The bill arrives later, when the pilot turns out to be load-bearing and nobody will sign off on it.
A worked scenario: nine agents, two engineers, one insurer
This is an illustrative scenario, not a customer result. A two-person platform team at a mid-size insurer in Pune runs nine agents: claims triage, policy summarisation, three internal search bots, two reconciliation jobs and two assistants in finance. All nine authenticate as svc-ai-platform, which holds read on the claims warehouse, write on a ticketing system and send on a shared mailbox.
The reconciliation agent then ingests a maliciously crafted PDF. The injection does not need to break the model's reasoning, only to make it call a tool, and the tools it can reach include a mailbox that was scoped for a different agent entirely. One identity, nine agents, and the weakest of the nine sets the blast radius for all of them.
Split that into nine identities carrying only the scopes each one genuinely uses, and the same injection gets a 403 on its first interesting call. That is the whole argument, and it beats any dashboard.
Also read: What Is Prompt Injection in 2026? How Indirect Attacks Work and 7 Defences That Hold.
Entra Agent ID vs Google Agent Identity vs the open stack
Three credible options exist as of October 2026, and they are not interchangeable: each assumes you already live somewhere.
| What you get | Microsoft Entra Agent ID | Google Agent Identity | Open stack (SPIFFE plus your IdP) |
|---|---|---|---|
| Identity format | Entra directory object per agent | SPIFFE-formatted ID, per docs | SPIFFE SVID, X.509 or JWT |
| Where it is bundled | Into Agent 365, per Microsoft licensing guides | Gemini Enterprise Agent Platform | Nothing; you assemble it |
| Resource-level grants | Across Entra-governed resources | Buckets and BigQuery datasets, per docs | Whatever your policy engine understands |
| Works outside the vendor | Weak; it is strongest inside Microsoft | Weak outside Google Cloud and Workspace | Strong, that is the point |
| Delegation model | Entra-native, Copilot Studio aware | OAuth-propagated user permissions | RFC 8693 token exchange, you own it |
| Per-call authorization | Policy tooling, still maturing | Agent Gateway governance path | You bring the policy engine |
| Effort to adopt | Low if you already run Entra | Low if you already run Gemini Enterprise | High, weeks not days |
| Who it suits | Microsoft-first enterprises | Google-first enterprises | Multi-cloud or regulated teams needing portability |
IBM is the fourth name worth tracking. It announced general availability of IBM Agent Identity alongside HashiCorp Vault 2.2, which matters if your secrets already live in Vault.
Agent identity facts worth memorising
The four figures that come up in every design review.
From the MCP authorization specification, IETF RFC 8693, Google Cloud documentation and NIST announcements, checked 27 October 2026.
Designing across two of these clouds at once is the judgement the CCAR-F architect foundations prep course drills, while the Entra and Azure policy side sits inside the Azure Solutions Architect and DevOps programme.
What AI agent identity costs in 2026
The pricing question gets asked wrong. Teams ask what an agent identity costs per agent. You are billed on seats and on the platform, and the identity rides along.
Third-party Microsoft licensing guides, as of October 2026, list Agent 365 at $15 per user per month standalone or included in the Microsoft 365 E7 suite at $99 per user per month, with Entra Agent ID described as part of Agent 365. The same guides list Entra ID P1 at $7 and P2 at $10 per user per month after a 1 July 2026 increase from $6 and $9, and Entra Workload ID Premium at $3 per workload per month. These are reseller figures, not a Microsoft price page, so confirm them against your own agreement before you budget.
Back to the Pune insurer. Finance and claims total 80 seats. At $15 per user per month that is roughly $1,200 a month, about Rs 1.07 lakh at 89 rupees to the dollar, covering the management layer for all nine agents. Building nine identities, a registry and a policy gate yourself costs two engineers for six weeks, and it is not finished at the end of six weeks either.
The open stack flips that. No licence, and the entire cost is engineering time plus the policy engine and secret store you already run. If you are multi-cloud, or you need the design to survive a vendor change, pay that bill. If you are a Microsoft shop with 80 seats, do not.
- Two agents do not need a platform. One or two internal agents on a read-only dataset do not justify an identity platform. Give each a separate scoped credential and move on.
- The standards are not settled. The IETF WIMSE draft covering agent identity expired on 1 September 2026, so nothing here is a stable long-term reference yet. Build on token exchange and the identity provider you already run, which will still be there in 2028.
- Identity does not stop a confused deputy. OAuth 2.1 confirms the token is valid and scoped. It does nothing about an agent talked into using a legitimate scope for an illegitimate purpose. That needs per-call authorization plus a human gate on anything irreversible.
- The vendor pitch oversells inventory. A dashboard listing 200 agent identities is a nice artefact and a poor control. What reduces risk is the scope on each one and the name attached to it.
Is non-human identity worth learning in 2026?
Yes, and not because it is fashionable. It sits where two shortages overlap: people who can build agents, and people who can get an agent through a security review. Most engineers have one of those.
Two signals say the budget is real. Palo Alto Networks' 2026 survey reports nine in ten organisations suffered a successful identity-related breach in the preceding twelve months. On the standards side, NIST announced its AI Agent Standards Initiative in February 2026 and its NCCoE opened a project on software and AI agent identity and authorization, which is the usual precursor to a procurement checklist item.
Regulators are moving too. A Boston Identity research briefing reports that Singapore's IMDA published a model AI governance framework for agentic AI, naming GovTech as having phased its coding-assistant rollout with MCP access gated through a governance front door. That is a digest-level report rather than a primary source, but the direction is clear enough to plan around.
For the practical version: agent design and tool-scoping are hands-on work in the AI Engineer course covering RAG and AI agents, credential rotation in production sits in the MLOps Engineer programme, and the tenant-level Copilot agent administration view is what the Microsoft 365 Copilot and Agent Administrator course (AB-900) is built around. The full certifications overview lays out the sequence.
Agent identity is a deployment problem, and deployment is what the FDE course trains
Forward Deployed Engineer: Enterprise AI Deployment runs 110+ hours live over 18 weeks, with mentor-reviewed work on real deployments and dual Microsoft and Anthropic certification prep. You practise the parts that decide whether an agent ships: scoping tools, wiring delegation and surviving the security review.
Explore the course
6 steps to give your agents their own identity
Do these in order. Step four is the one people skip and then regret.
- Inventory what authenticates today. Grep your pipeline variables and secret store for every credential an agent uses, and write down agent, credential and scopes. Most teams find two or three agents they had forgotten.
- Give each agent a sponsor before an identity. One named human per agent, in the identity object's metadata or a registry row. No sponsor, no identity, no deploy. This is the control that survives staff turnover.
- Issue one identity per agent, from your existing provider. Entra Agent ID if you run Entra, a SPIFFE SVID if you run a service mesh. Do not buy a new identity platform to solve a nine-agent problem.
- Cut scopes to what the agent used last week, not what it might need. Start read-only. Add a write scope only when a specific call fails and you can name the business reason. Every speculative scope is one a prompt injection inherits.
- Put a policy gate on every tool call and a human gate on irreversible ones. Payments, outbound email, deletes and anything customer-visible go through an approval queue. Tokens live 15 minutes, not 24 hours, with refresh rotation.
- Make decommissioning part of the deploy. When the agent is retired, the identity, the scopes and the registry row go with it. Set an expiry on the identity so neglect fails closed instead of open.
What usually goes wrong here
Put it the way a colleague would at your desk rather than the way documentation does. The failure is almost never the cryptography. It is that somebody needed the pilot working by Thursday, and the fastest path was a credential that already had everything.
Four failures that show up again and again
Each one has a fix that takes under a day if you catch it early.
The orphan with write access
A March pilot still holds a write scope in October because the engineer who built it changed teams, and nobody will revoke it in case something depends on it. Fix: expiry dates on identities, so neglect revokes them for you.
LifecycleAgent-to-agent chains nobody can trace
Agent A calls agent B, which calls a tool, and the identity gets flattened in the middle. A Microsoft roundtable at Identiverse 2026 reportedly heard from teams who rolled back agent-to-agent deployments over exactly this. Fix: propagate both identities, or do not chain yet.
DelegationTokens that live for a day
A 24-hour token is useful to an attacker for 24 hours. Teams pick long lifetimes to dodge refresh bugs, then ship the refresh bug anyway. Fix: 15-minute tokens with rotation, tested in staging before anyone argues about it.
CredentialsAudit logs that name the wrong actor
Every agent action is attributed to whoever authorised the integration. The log is technically complete and practically useless, and you find out during the audit. Fix: the actor field carries the agent, with the delegating human as a separate attribute.
AttributionPatterns drawn from vendor documentation and practitioner reports reviewed on 27 October 2026; the Identiverse item is secondhand and anecdotal.
One more, because it costs the most to undo: letting the agent inherit a human's token because it was faster. Six months on, that person's access has grown and the agent's permissions grew with it. Nobody noticed, because no configuration file changed.
Also read: Microsoft Agent 365 in 2026: How the AI Agent Control Plane Works, What It Costs and 6 Steps to Get Started.
Related guides
- What Is AI Agent Observability in 2026? identity tells you who acted, tracing tells you what the agent did between calls.
- AI Agent Sandboxing in 2026 the containment layer that limits damage when a scope turns out to be too wide.
- What Is the DPDP Act for AI Agents in 2026? the Indian compliance reason your audit trail has to name the right actor.
- Forward Deployed Engineer Skills in 2026 where this work sits in a job description, and which eight skills employers actually screen for.
- AI Engineer Salary in India 2026 what the governance-plus-build combination is worth in advertised pay bands.
- AI Engineer Jobs in Hyderabad 2026 the GCC employers running the enterprise agent deployments that need this skill.
Frequently asked questions
What is AI agent identity in simple terms?
It is giving an AI agent its own login instead of letting it use yours or a shared one. The agent gets a credential that belongs to it, permissions sized to its job, and log entries under its own name. When something goes wrong you can revoke that one agent without touching anything else.
What is the difference between agent identity and a service account?
A service account is usually one static credential shared by many automations, holding the union of every permission any of them ever needed. An agent identity is one per agent, attested rather than secret-based, and attached to a named sponsor. The practical difference is revocation: you can kill one without breaking the other eight.
Is Microsoft Entra Agent ID free?
Not as a standalone item. Third-party Microsoft licensing guides as of October 2026 describe Entra Agent ID as bundled into Agent 365, listed at $15 per user per month or included in Microsoft 365 E7 at $99 per user per month. Confirm against your own Microsoft agreement, since reseller pages lag official pricing.
Do I need OAuth 2.1 for AI agents?
If your agent talks to tools over the Model Context Protocol's HTTP transport, effectively yes: the specification adopted OAuth 2.1 in January 2026, making PKCE mandatory and removing the implicit and password grants. Autonomous agents use the client credentials grant; user-delegated work uses an on-behalf-of exchange, typically RFC 8693.
How many identities does one AI agent need?
One identity, and as many scoped tokens as it has distinct jobs. The identity is stable and tied to the workload; the tokens are short-lived, issued per resource, and narrow enough that a leaked one is close to useless. If an agent needs two very different permission sets, that is usually two agents.
Is non-human identity a good skill to learn in India in 2026?
It is one of the better bets, because it sits between agent building and security review and few engineers do both. Demand follows enterprise agent rollouts, which is where GCCs and large Indian IT services firms are investing. Industry reports suggest identity-related incidents remain near universal at large organisations, so the budget exists.
Can an AI agent have its own email address?
In some platforms, yes. Coverage of Google's 2026 enterprise announcements reports persistent agents receiving their own Workspace identity with an email address and storage, so their actions appear under the agent's name in version history. That reporting is secondhand rather than from a Google product page, so verify before designing around it.
What happens when an agent is decommissioned?
Whatever you built into the deploy process, which for most teams is nothing. Retire the identity, revoke the scopes, drop the registry row and keep the audit history. An expiry set at creation time is the cheapest safeguard: if everyone forgets, it fails closed instead of lingering with write access.
If I were the second engineer on that Pune platform team, I would not buy anything this quarter. I would spend one week splitting the shared service account into nine identities, attach a named sponsor to each, cut every scope back to read-only, then add write scopes one failed call at a time. That is most of the risk reduction for none of the licence cost, and it gives you the honest inventory you need before any platform purchase makes sense. The trade-off I am accepting is no cross-cloud dashboard, and I think it is a good trade. If your next step is doing this inside a real enterprise deployment rather than on a laptop, the Forward Deployed Engineer course is where that work is practised live.
About this guide. 360 Digital Transformation is an Anthropic Partner and a Microsoft Authorized Training Partner. Other certification bodies, vendors and employers named here are not affiliated with us. Product features and pricing change often; figures cited were checked on 27 October 2026.
Python
Claude API
OpenAI API
FAISS
ChromaDB
LangChain
LangGraph
CrewAI
