05 Sep 2025 AI Engineering 5 min read

Agent Governance: Identities for the Non-Human Workforce

Agents act, so they need governed identities. This article defines agent identity, examines Microsoft Entra Agent ID and the MCP authorization model, and lays out least privilege at the tool boundary, delegation-aware audit trails, and shadow-agent discovery — including what each control does not solve and which control planes we expect next.

Agents Are Workers Without Badges

Autonomous agents now open pull requests, triage tickets, and call internal APIs. They act, which means they hold permissions. Yet most organizations run them on borrowed credentials: a developer's OAuth token, a shared service account, an API key in an environment variable. The actor is new; the identity model is not. That gap is the governance problem of late 2025.

The scale is measurable. CyberArk's 2025 Identity Security Landscape counts 82 machine identities per human identity and expects AI to become the top creator of new privileged identities in 2025. Gartner predicts that by 2028, 25 percent of enterprise breaches will be traced back to AI agent abuse. Both numbers predate most production agent deployments. The curve points in one direction.

Untrusted input arrives — treat it as data, not instructions. 1/4

An Identity for Every Non-Human Worker

An agent identity is a directory object that answers four questions: who created this agent, on whose behalf does it act, what is it allowed to do, and when was it last active. It is not a service account. A service account represents a fixed workload; an agent identity represents a delegated actor whose behavior varies with its instructions.

Microsoft shipped the first mainstream implementation on 19 May 2025. Entra Agent ID, announced in public preview at Build, automatically assigns a directory identity to every agent created in Copilot Studio or Azure AI Foundry. Agents appear in the Entra admin center under the application type Agent ID (Preview). The preview delivers inventory and visibility. Conditional Access, multi-factor enforcement, and least-privilege roles for agents are announced but not yet generally available.

Identity alone changes little. The value appears when lifecycle processes attach to it: an owner who answers for the agent, an expiry date, a review cycle, and deprovisioning when the owning team dissolves. An agent without a responsible human is not an asset; it is an unattended process with credentials.

Least Privilege at the Tool Boundary

For an agent, permissions materialize at the tool boundary, not in a role definition. The Model Context Protocol revision of 18 June 2025 formalizes this: MCP servers act as OAuth 2.1 resource servers, clients must send RFC 8707 resource indicators so each token is bound to one server, and token passthrough between servers is explicitly forbidden. The practical consequence: one scoped, short-lived token per tool rather than one broad token per agent.

Scoped tokens bound the blast radius; they do not prevent misuse of legitimate scope. A prompt-injected agent with read access to a mailbox will read the mailbox. Least privilege for agents therefore needs a second axis: task-scoped grants that expire when the task completes, and human confirmation for irreversible actions. We treat every standing tool grant as a liability until it is time-boxed.

Audit Trails That Capture Delegation

Classic audit logs record principal, action, resource, and timestamp. For agents this is insufficient, because the interesting question is why. A useful agent audit trail records the delegation chain — user to agent to sub-agent to tool call — plus the instruction that triggered the action and the model output that decided it. Without the chain, an incident review cannot distinguish a compromised agent from a badly prompted one.

OWASP's Agentic AI Threats and Mitigations guide (February 2025) catalogs the failure modes such logs must cover: memory poisoning, tool misuse, privilege compromise, and cascading failures across multi-agent systems. Be precise about what a trail delivers. It is forensic, not preventive. It shortens investigations; it prevents nothing on its own.

Discovering Shadow Agents

Shadow agents are agents nobody registered: a scheduled script holding an LLM API key, a no-code automation under a personal account, a browser extension acting on a logged-in session. They follow the familiar shadow-IT pattern — but with write access, with autonomy, and without an entry in any directory.

Discovery is unglamorous and works: inspect egress traffic for calls to known model and tool endpoints, scan repositories and vaults for AI-service credentials, review SaaS admin consoles for automation features someone enabled, and reconcile expense data against the sanctioned vendor list. Entra Agent ID automates discovery only for agents built inside Microsoft's two builders; everything else remains a manual census in September 2025.

What These Controls Do Not Solve

Governance controls compose; none is sufficient alone. The table summarizes the honest scope of each control as it stands in late 2025. We use it to set expectations before an agent program starts, because a control that is oversold becomes the finding in the next audit.

The table is also the argument for layering. No single row governs an agent; the four together produce accountability. The residual risk — a correctly identified, minimally privileged, fully logged agent doing the wrong thing convincingly — is a model-behavior problem. Identity infrastructure cannot solve it, and vendors who claim otherwise are selling the wrong layer.

Control	What it provides	What it does not provide
Agent identity	Inventory, ownership, lifecycle	Correct behavior of the agent
Scoped tool tokens	Bounded blast radius per tool	Protection against misuse of granted scope
Delegation-aware audit trail	Forensics and accountability	Real-time prevention
Shadow-agent discovery	Visibility of unregistered agents	Coverage outside monitored channels

The Coming Control Planes

The direction is visible in September 2025. Identity vendors will fold agents into workforce IAM: registries, joiner-mover-leaver processes, and Conditional Access for non-human workers. Microsoft has announced exactly this trajectory for Entra; the ServiceNow and Workday partnerships point to agents provisioned like employees. We expect the major IAM suites to ship agent registries as standard features during 2026.

Protocol work converges next. MCP settled tool authorization on OAuth 2.1. Google's A2A protocol, donated to the Linux Foundation in June 2025, addresses agent-to-agent communication and will need the same identity rigor. The open problem is delegation: a standard token that carries the full user-to-agent-to-tool chain does not exist yet. Token exchange per RFC 8693 is the likely substrate.

Our prediction, stated plainly: within two years, deploying an unregistered agent will be treated like deploying an unregistered server today — a policy violation, not an oversight. Organizations that build the inventory now will find that transition boring. Boring is the goal.