Agentic AI demands unified approach to human and non-human identity

By Michael Hubbard, Chief Customer Officer, Ping Identity

Across our customers and broader enterprise landscape, agentic AI is moving out of pilot programs and into real workflows, with nearly 80% of organizations using AI in at least one business function. Autonomous agents can now take action, make decisions, and complete transactions on behalf of users. This shift is changing how work gets done, while reshaping service delivery and how trust is established in digital environments.

At the center of this transformation sits digital identity and the level of assurance behind it. As organizations accelerate their AI strategies, a new challenge is taking shape. How do you extend trust to entities that are not human, but act with human authority? How do you ensure that trust is grounded in verified, high-assurance identity markers?

Across the organizations we work with, the question is no longer theoretical. It is directly impacting how quickly teams can deploy AI-driven services while maintaining customer trust and regulatory confidence.

A growing divide in how organizations approach agentic AI

In one camp are teams carefully adapting existing human identity systems to the situation at hand. They are exploring how to evolve governance models and access controls to more effectively support agentic AI and other non-human identities (NHIs).

In the other camp are teams focused on purely speed and innovation. They are deploying AI agents rapidly to unlock productivity and automate workflows. In many cases, these agents operate outside of centralized identity systems, without consistent governance or visibility.

In practice, many organizations are navigating both paths at once: balancing pressure to innovate quickly with the need to maintain trust, compliance, and operational visibility. Both approaches are understandable, but this divide creates both risk and opportunity for organizations.

When agents operate without a connection to the enterprise identity fabric, several issues emerge. Organizations have limited visibility into what they are doing. Accountability becomes unclear, access can expand beyond intended boundaries, and attack surfaces grow as these agents become targets for misuse or compromise.

In many organizations, trust in digital systems today is rooted in strong identity verification processes, including biometric and multi-factor authentication, that establish confidence in human users, but are not yet consistently extended to the agents acting on their behalf. These gaps go beyond just introducing risk. They can erode customer trust, disrupt digital experiences, complicate regulatory compliance, audit readiness, and attestation requirements, and slow the adoption of AI-driven services.

At the same time, the upside is significant. Agents can streamline operations, reduce manual effort, and enable new forms of digital interaction. They can act continuously, respond in real time, and execute complex tasks at scale.

For identity and security teams, the goal is to support innovation while ensuring it is grounded in trust. For business leaders, the goal is equally clear: deliver these innovations in a way that customers, partners, and regulators can trust.

Bringing agents into the identity fabric

This divide is emerging as security and identity teams are being asked to support AI-driven initiatives that move faster than traditional governance models. These legacy models are built around session-based trust and static credentials and are not designed for autonomous systems that operate continuously at machine speed, further amplifying risk. Meanwhile, development and business teams are under pressure to deliver results quickly, often bypassing centralized controls to do so.

Bridging this divide requires a mindset shift. NHIs must be treated as first-class citizens within the identity ecosystem, with clear guardrails that define what actions an agent can take independently and when human oversight is required.

From a customer perspective, this is what ensures AI-driven interactions remain consistent, secure, and predictable, even as automation scales. In practice, this means recognizing that every AI agent is its own identity, with defined permissions, context, and responsibilities, operating within a unified identity framework that spans both human and machine actors. Like human users, these entities need defined roles, lifecycle management, authentication methods, and policy enforcement.

Establishing appropriate governance policies is also key. Identity and access management teams must first discover and register these agents, then define how they  are created, authenticated, and authorized. There are a few things to keep in mind in this regard:

1) All AI agents should be tied to clear ownership, lifecycle controls, and system-of-record governance  within the identity ecosystem.

2) Access should be granted based on least privilege, and adjusted dynamically based on context and risk.

3) Ongoing monitoring is essential to detect anomalies and respond in real time.

4) Policies should reflect the level of risk associated with each agent’s function and access level.

Organizations that get this right are able to move faster with confidence, reducing friction for developers while maintaining the guardrails needed to protect customer data and experiences.

Continuous authentication also plays a critical role. Agents need strong, verifiable credentials that can be managed and rotated securely, and that are anchored to high-assurance identity verification, whether through biometrics, document verification, or multi-factor authentication used to establish the originating user’s identity. Static credentials and shared data introduce unnecessary exposure by allowing agents to broadly impersonate human users. Modern approaches, such as OAuth 2.0, an authorization framework for explicitly delegating API access via tokens, focus on dynamic, policy-driven authentication that adapts to context and maintains strict boundaries.

Most importantly, authorization must move from a one-time decision at login, even when that login is backed by strong authentication like biometrics, to continuous, contextual enforcement at runtime that evaluates every action an agent takes against policy, risk, and intent. This is essential not just for security, but for ensuring that every interaction, whether human or machine, aligns with expected outcomes and user trust.

Equally important is accountability. If an agent initiates a transaction or accesses sensitive data, there must be a clear audit trail. Organizations need to know not only what happened, but also who was responsible and under what conditions. Without this level of transparency, it becomes significantly harder to maintain trust with customers, partners, and regulators as AI adoption grows.

By embedding these controls into the identity layer, enterprises can ensure that agents operate within well-defined limits while still delivering value.

A collaborative path forward

This shift will broaden the role of identity and access teams, who will be responsible for defining policies, roles, and verification methods that govern how AI agents operate within clearly defined trust boundaries. Rather than acting as gatekeepers, security and identity leaders should partner with teams building and deploying AI agents, providing frameworks and tools that enable secure development from the start.

The most successful organizations we see are those where identity, security, and innovation teams are aligned early, not retrofitting controls after deployment but embedding trust into the design of AI-driven experiences. This includes enabling “human-in-the-loop” controls where high-risk or sensitive actions require explicit human approval, ensuring AI operates with both autonomy and oversight.

At the same time, innovation teams must recognize that identity is not a constraint, but rather the foundation that enables agents to act safely and at scale. When done right, identity becomes an accelerator, enabling faster rollout of AI capabilities without compromising trust.

This collaboration will lead to the emergence of a new, unified identity discipline within the enterprise that encompasses both human and non-human entities. It will bring more consistent governance and shared accountability, helping organizations maintain integrity as AI adoption accelerates.

Where identity leaders go from here

Agentic AI is reshaping the enterprise, while raising the bar for how trust is established and maintained. Organizations that bring structure to how agents are identified, governed, and trusted, and ensure every interaction, decision, and transaction is continuously verified in context, will be best positioned to scale these technologies responsibly.

As organizations invest in biometric and high-assurance identity systems, extending that same level of trust to AI-driven entities will be critical. More importantly, they will be better positioned to deliver the kinds of secure, seamless digital experiences that customers increasingly expect.

The next phase of identity is already taking shape. By aligning teams, defining clear ownership, and embedding trust into how agents operate, enterprises can move forward with confidence and turn AI-driven change into a durable advantage. In this next phase, identity will not just secure AI. It will define how organizations earn and maintain trust in an increasingly autonomous digital world.

About the author

As Chief Customer Officer, Michael is responsible for every customer’s experience and achievement of value, marshalling customer success and renewals, technical support, and professional services organizations. Prior to joining Ping Identity, Michael held leadership positions with Smartsheet, ServiceNow, VMware, and Oracle focused on enabling customer value. He has a proven track record of implementing and scaling data-driven, repeatable processes to drive customer operations and revenue growth.

Article Topics

AI agents  |  authorization  |  continuous authentication  |  digital identity  |  identity fabric  |  identity governance  |  identity management  |  non-human identities  |  Ping Identity