Agent Identity's Ownership Vacuum: Who Governs?

AI agents are moving fast from controlled pilots into production — running across public clouds, on-premises systems and private clouds, staying online continuously, making runtime decisions, and spanning multiple platforms at once. A Cloud Security Alliance survey of 285 IT and security professionals, commissioned by Strata, exposes the same underlying problem: identity governance is not keeping pace with adoption, and enterprises are stuck in a trust gap between pilot and production.

The Ownership Vacuum: Nobody Owns Agent Identity

The core finding is a missing locus of responsibility. Only 23% of organizations have a formal, enterprise-wide strategy for agent identity management; another 37% rely on informal practices — essentially making it up as they go. Ownership is fragmented across security teams (39%), IT departments (32%), and emerging AI-security functions (13%), with no clear accountability.

Audit readiness is equally sobering: fewer than half of respondents are "somewhat confident" they could pass a compliance review focused on agent behavior. Most simply cannot demonstrate proper control over these autonomous systems to corporate governance or regulators.

The Confidence Problem: Why IAM Can't Hold Autonomous Entities

Only 18% of security leaders are highly confident their current IAM systems can effectively manage agent identities; the rest are moderately confident (35%), slightly confident (29%), or have little to no confidence (18%). That distrust shows up in fundamentals. When asked how agents are authenticated, answers revealed broad reliance on static methods built for an older era of machine identity: 44% use static API keys, 43% use username-and-password combinations, and 35% rely on shared service accounts.

These are persistent, often unmonitored access paths — exactly what you do not want for autonomous systems running 24/7 across platforms. The visibility gaps are worse: only 28% can reliably trace agent actions back to a human sponsor across all environments; just 21% maintain a real-time inventory of active agents. Nearly 80% of organizations deploying autonomous AI cannot tell you, in real time, what those systems are doing or who is responsible for them.

The Human Bottleneck: Blocked from Production, Blocked from Scale

When teams cannot trust visibility and control, they do what they always do: they delay moving to production. 68% rate human-in-the-loop (HITL) oversight as "essential" or "very important" — requiring human validation before agents access sensitive data (69%), make system changes (68%), or approve financial transactions (62%). But they lack an architectural way to insert out-of-band liveness checks and consent approvals at policy-defined thresholds.

The result: agents are relegated to mundane, low-risk projects that barely move ROI. This is not a people problem — it is a structural gap in identity infrastructure. Without the ability to embed HITL checkpoints at policy thresholds, scaling autonomy is not possible.

Investment Is Following, but the Base Is Low

The good news is that organizations are putting real resources behind the problem: 40% are increasing identity and security budgets specifically for AI agent risk, and 34% have established dedicated governance budget lines. The drivers mirror the structural weaknesses the survey found: sensitive data exposure (55%), unauthorized actions (52%), credential misuse (45%), lack of identity standards (45%), and inability to discover or register agents (40%).

But the base is low — only 40% of organizations already have agents in production, with the rest in pilots or planning. The earlier governance is fixed, the cheaper scaling becomes; rebuilding an identity layer after hundreds of agents are already live typically forces retrenchment.

The Way Out: Identity Infrastructure Built for Autonomous Entities

The research makes one thing clear: the traditional IAM playbook does not work for autonomous agents. Static credentials, over-permissioned tokens, and siloed policy enforcement cannot keep pace with entities that operate continuously, make runtime decisions, and span multiple platforms. They introduce unacceptable business risk and block Agentic AI adoption.

The path forward is purpose-built infrastructure: AI identity gateways acting as policy enforcement points in front of critical resources and existing MCP servers, using OBO token exchange for dynamic authentication, runtime authorization, continuous traceability, and unified orchestration across every environment where agents operate. The agentic era is already here — the question is no longer whether to adopt agents, but whether your identity infrastructure can support them securely as they scale.

References:

• Strata: The AI Agent Identity Crisis — New Research Reveals a Governance Gap
• Cloud Security Alliance: Securing Autonomous AI Agents — Survey Report
• CSA Research Note: The AI Agent Governance Gap — What CISOs Need Now