AI agents are becoming the fastest-growing class of enterprise identities, yet most organizations lack a governance plan for them. Each agent should have its own distinct identity rather than borrowing human credentials or generic service accounts. Authentication relies on OAuth 2.0: use the on-behalf-of (OBO) flow when an agent acts for a user, and client credentials when acting autonomously. Short-lived federated credentials should replace long-lived secrets, and tokens should be scoped per resource. For high-risk actions, out-of-band human approval (e.g., hardware-key-backed CIBA flows) creates a verifiable accountability chain. Platforms like Microsoft Entra Agent ID, Okta, and CyberArk are building dedicated agent identity tooling. Best practices include assigning every agent a named owner with a lifecycle, enforcing least privilege, and continuous runtime audit logging.
