AI Identity for Agentic Systems: Integrating PAM and IAM for Secure Autonomy

Abstract

Agentic AI systems, as autonomous agents that make decisions and take actions in enterprise environments, raise identity governance questions regarding agents that maintain state, collaborate, and request escalation of privileges to perform complex activities, different from the questions that human actors, service accounts, and API tokens raise in identity governance contexts. The article outlines the existing challenges of establishing customary IAM for agentic AI and proposes a thorough framework building on IAM and PAM elements for holistic oversight of agentic AI. This framework entails considering agentic AI as first-class identity subjects, being responsible for their lifecycle, and dynamically provisioning their credentials. It also provides context-aware policy enforcement and continuous behavior monitoring. Augmenting IAM's identity controls with PAM's privileged operations governance satisfies operational autonomy and security requirements, increases accountability and compliance, and ensures the trustworthiness of autonomous AI operations while countering privileged credential theft, privilege escalation, and audit trail deficiencies stemming from customary identity-centric approaches to PCC management of autonomous AI operations.