Enterprise identity architecture has historically centered on people, applications and service identities. That model remains essential, but autonomous and delegated AI agents introduce a different operating pattern: a software actor can select models, call tools, traverse systems, delegate work and change business state at machine speed.
Identity must describe the actor performing the work
For enterprise AI, authentication alone is not enough. A control system needs to answer a broader set of questions before a material action is allowed: What is acting? Who sponsors it? What business purpose was approved? Which model and workload are in use? What tools and data can it reach? Where did its authority originate? Is that authority still valid?
This is the identity gap created by agentic systems. A human may initiate a workflow, but the final action can be produced by a model, sub-agent, tool or workload several steps later. If the organization only preserves the identity of the initiating user, the operating context becomes incomplete.
Four forms of agent authority require different controls
Enterprise agents do not all receive authority in the same way. An on-behalf-of agent acts through a live human session and should not outlive or exceed that session. A delegated agent can continue after the user steps away, but it needs a named sponsor, a bounded scope and an expiry. An autonomous workload can operate without a live human session, so commissioning policy becomes the authority ceiling. A sub-agent should inherit only the minimum subset of authority required for its task.
Treating every one of these actors as a generic service account collapses important distinctions. Identity should preserve the source and limit of authority, not just a credential.
The enterprise needs a common trust layer, not another universal IdP
The practical architecture is additive. Human authentication remains with the enterprise identity provider. Existing IAM, cloud, AI, security and governance systems remain systems of record and enforcement. The missing layer is a portable identity and policy object that adds agent, model, workload, compute, delegation and evidence context across them.
That common trust layer can consume assertions from enterprise identity, resolve agent ownership and relationships, bind policy to the AI actor, and return signed status and obligations to gateways, tools, model endpoints and workloads where enforcement actually occurs.
Identity becomes a lifecycle
An agent identity should move through explicit stages: registration, verification, issuance, execution, monitoring, suspension, review and retirement. Material changes to sponsor, purpose, model, tool set, workload, region, data class, cryptographic key or authority should trigger impact review and, when required, re-issuance.
This lifecycle is important because agent risk is not static. The environment can change after approval. A model can be substituted. A workload can move region. A tool can gain a new destination. A key can be rotated or compromised. Continuous identity status gives the enterprise a way to react without waiting for the next periodic access review.
The goal is attributable automation
AI identity infrastructure should make autonomous work explainable in operational terms. The enterprise should be able to trace an action to a persistent actor, named sponsor, authority source, approved model, runtime environment, policy decision and resulting evidence. That is the foundation for scaling AI agents without losing ownership or accountability.