Why Traditional IAM Falls Short for AI Agents

Summary

The article argues that human-centric IAM cannot adequately govern AI agents across API workflows. It recommends application-centric runtime authorization with short-lived, least-privilege tokens using OAuth 2.0, token exchange and dynamic client registration.

Key points

• The article says non-human identities account for more than 90% of authentications and that AI agents can trigger chains of API calls.
• It argues that treating short-lived agents as persistent directory identities can create identity sprawl and orphaned permissions.
• The proposed model evaluates authorization continuously, based on the application, action, data and context.
• It recommends short-lived, just-in-time, least-privilege tokens that carry information about the acting agent, represented user and requested action.
• The article identifies OAuth 2.0, token exchange and dynamic client registration as existing standards that can support this model.
• Curity Access Intelligence is presented as a product intended to address the runtime-governance gap.

Vendors

Products