AI Agents Need Better Identity Management Now

As artificial intelligence systems become more autonomous, they are taking on tasks that require accessing sensitive data and performing actions on behalf of users. This shift from simple chatbots to active decision-makers creates urgent security challenges that current identity and authorization systems weren't designed to handle. The rapid adoption of AI agents across industries means we need new approaches to ensure these systems operate securely and accountably.

Researchers have identified that today's authentication frameworks work well for AI agents operating within single domains, such as enterprise environments where they access internal tools through protocols like the Model Context Protocol (MCP). However, these systems break down when agents operate across multiple domains, engage in asynchronous long-running tasks, or delegate work to other agents. The fundamental problem lies in how we identify and authorize these non-human actors while maintaining clear accountability trails.

The paper outlines several existing solutions that provide immediate security improvements. For enterprise deployments, integrating AI agents with Single Sign-On (SSO) and SCIM provisioning allows organizations to manage agent identities similarly to human employees. The Model Context Protocol has emerged as a leading framework for connecting AI systems to external tools, though its initial design lacked robust authentication features that have since been added through community feedback. Client Initiated Backchannel Authentication (CIBA) provides a mechanism for handling asynchronous authorization where agents need human approval for high-risk operations without blocking entire workflows.

Analysis shows that current systems create significant security gaps when agents operate beyond single-domain scenarios. The researchers found that agent fragmentation—where different vendors develop proprietary systems—forces repeated integrations and creates vulnerability risks. User impersonation, where agents act indistinguishably from humans, creates accountability gaps. Perhaps most concerning is the scalability problem: as users face thousands of authorization requests from proliferating agents, they risk reflexive approval without proper consideration.

These findings matter because AI agents are increasingly handling sensitive operations in finance, healthcare, and critical infrastructure. Without proper identity management, organizations face risks ranging from data breaches to unauthorized actions with real-world consequences. The transition from simple software clients to autonomous agents requires rethinking how we establish trust in digital systems.

The paper acknowledges several limitations in current approaches. Recursive delegation—where agents spawn sub-agents—creates complex authorization chains without clear attenuation mechanisms. Browser-based agents that control visual interfaces can bypass API-based controls entirely. Multi-user environments present challenges when agents acting on behalf of one user share outputs with others who may not have the same permissions. These gaps highlight areas where further research and standardization are needed to build secure, scalable agent ecosystems.