Every agent your organisation runs holds an identity. It authenticates to something, it carries a credential, it appears in a log under a name. That part is unavoidable — nothing reaches a system of record anonymously. What is avoidable, and almost universally skipped, is the part where somebody decides what that identity is, states in business terms what it may do, names who granted it, and puts a date on when the grant ends.
In most enterprises that decision was never made. The identity arrived as a side effect: a platform engineer needed a token on a Thursday so the pilot could work at all, and the pilot became production without anyone revisiting the question. The agent now runs under an authority nobody issued, scoped to whatever was convenient in week two.
This is the primitive underneath every other agent control, and it is the one that gets deferred, because an inventory produces no capability and demos badly. It is also considerably smaller than teams fear. What follows is the case for doing it first, the numbers that describe how few organisations have, and the distinction that determines whether the exercise is worth anything once it is done.
The population nobody counted
Start with scale, because every subsequent control is defined relative to a population, and almost nobody holds the number. Non-human identities — service accounts, API tokens, machine credentials, workload identities — outnumber human users in the average enterprise by roughly forty-five to one. In cloud-native estates the ratio reaches a hundred and forty-four to one, and the trajectory is the part worth sitting with: the same measurement placed it at ninety-two to one in the first half of 2024. That population grew about forty-four percent year over year between 2024 and 2025, and the fastest-growing segment inside it is agents.
A forty-five to one ratio is not a stable estate with a new label on it. It is a growth curve running well ahead of the process meant to govern it — and the growth is about to stop being something your platform team provisions deliberately. Agent identities increasingly arrive inside software you bought. Your service-management platform ships them. Your ERP ships them. Each one needs an identity, each one accumulates permissions, and the population grows by a mechanism nobody inside the enterprise controls.
The count is also, reliably, wrong in one direction. Organisations that run this exercise usually find several times more machine identities than their identity system reports, because a meaningful share were created outside it. That discrepancy is not noise to be reconciled away. It is the finding.
Four failures, four different owners
Read the 2026 survey data as a diagnostic rather than as alarm, and four distinct failures separate out. They are worth naming individually because they have different owners, different fixes, and different costs.
No inventory. Seventy-eight percent of organisations have no documented, formally adopted policy for creating or removing AI identities — from a Cloud Security Alliance and Oasis Security survey of 383 IT and security professionals fielded in late 2025. Only fourteen percent have fully automated that lifecycle; forty-one percent run it semi-automatically and twenty-seven percent do it entirely by hand. You cannot govern a population you have not enumerated, and every control below this one ends up applying to a subset nobody can characterise.
Over-permission. Fifty-one percent of the same respondents name over-permissioned access as a most-significant pain point; the same proportion report no clear ownership or accountability for AI identities at all. This is not a failure of diligence. It is the equilibrium outcome of a long-lived identity accumulating the union of every permission any workflow ever needed, because adding one unblocks somebody today and removing one might break something tomorrow. Nobody is rewarded for the removal.
No runtime visibility. A survey of 750 senior technology leaders across the UK and US in April 2026 found mean monitoring coverage of agents in production at fifty-two percent — just under half of deployed agents running unobserved — against near-universal executive confidence that visibility was in hand. Fifty-four percent had experienced or suspected an agent security or privacy incident in the preceding twelve months. Note what the coverage gap rules out beyond incident response: effective challenge, the reviewer's ability to reconstruct and question a decision. A system whose behaviour cannot be reconstructed cannot be validated, only asserted.
No lifecycle. A separate Cloud Security Alliance survey of 418 practitioners in January 2026 found that eighty-two percent had unknown AI agents somewhere in their infrastructure, and only twenty-one percent had a formal decommissioning process. Agents are created for a project, granted access, and then persist — through the project's end, the team's reorganisation, the platform migration. Nobody revokes them because nobody owns them. Authority in that system does not decay. It accumulates, monotonically, by construction.
One further figure ties the four together: ninety-two percent of those practitioners say they are not confident their existing identity and access management can manage the risks that AI and non-human identities introduce. The honest reading of that number is not that the tools need a version bump. It is that they were built to answer a different question.
A permission answers “can it reach”. An entitlement answers “may it, and on whose word”
A permission is a statement about reach. This identity can call this endpoint, read this table, write this record. It is evaluated against an identity, identities are long-lived by design, and the evaluation happens at a system boundary. Forty years of access control answer this question well, and there is nothing wrong with the answer.
An entitlement is a statement about authority. This principal granted this agent the ability to take this class of action, within these limits, for this period, for this purpose. It is evaluated against a grant, grants are bounded by design, and the evaluation happens at the moment of action. Four fields do the work: a named grantor who can be asked why, a scope expressed in business terms, constraints that travel with the action, and an expiry.
Every governance regime humans have built for delegated action — banking mandates, corporate authority schedules, medical consent, power of attorney — is organised around the second question. None of them are organised around reachability.
Here is the nuance that makes the distinction load-bearing rather than pedantic, and it is the part I would want a sceptical reader to press on. For a deterministic integration, the two questions collapse into one. A nightly job that reads a table and writes a file has a fixed path; its reach is its authority, because there is no other thing it can do with what it can reach. Permissions were a serviceable proxy for authority for four decades precisely because the actors were either humans with judgement or programs with fixed behaviour, and the proxy held for both.
An agent is neither. It is a delegated actor that chooses its own path to a goal, which means it will compose whatever it can reach into sequences nobody enumerated at grant time. That is where the proxy breaks, and it breaks completely rather than at the margins.
Composition is the part that is genuinely new
Consider an agent handed three permissions, each of which passed review on its own merits: read the customer record, call the pricing service, and append a note to the case file. No reviewer would reject any of the three. Each is narrower than what the person doing the job holds today.
Composed at runtime, they are the ability to construct a priced position against a named customer and record it in the system the next human will treat as authoritative. That is not a permission anybody granted. It is an authority that emerged from three grants that were individually reasonable, and no review of the three would have found it, because the reviews were of reach and the risk lives in the composition.
A human holding the same three permissions is bounded by knowledge, habit and fatigue: they use what their job requires and never discover the rest. An agent has none of those bounds. It holds the whole surface in working memory and will exercise any part of it the moment a plan suggests doing so. The sprawl was always there. The agent is the first actor patient enough to enumerate it — which is why the July 2026 Hugging Face disclosure ran to more than seventeen thousand recorded actions across a single weekend. That is not the profile of an intruder taking what it came for. It is the profile of something methodically walking a space nobody had mapped.
What these numbers do not prove
The survey bases are small and self-selected. The 383- and 418-response samples were fielded through security-industry channels, and people who answer a non-human-identity survey already think about non-human identity. That cuts both ways: they may be more mature than average or more alarmed. I would treat these as directionally reliable and would not put them in front of a board as a population estimate.
The ratios are worse as evidence than they look. Forty-five to one and a hundred and forty-four to one are built on discovery tooling, and discovery tooling finds what it can see. If a meaningful share of machine identities exist outside the identity system — which is what these same surveys report — then the denominator is confident and the numerator is a lower bound. The honest version is that the ratio is at least this bad and the direction is up.
And least privilege has a long history of losing for reasons an inventory does not solve. Every generation of security practice has advocated it and every generation has watched it lose to delivery pressure. I am not claiming entitlements succeed where least privilege failed because the idea is better. I am claiming a different failure mode: a grant that expires on a timer fails toward restriction, whereas a permission that persists fails toward accumulation. That is a structural property rather than a cultural one, and structural is the only kind that survives contact with a delivery schedule.
The same question, on three different clocks
In North America the revised interagency model risk guidance of 17 April 2026 — OCC Bulletin 2026-13 and its parallel Federal Reserve and FDIC issuances, superseding SR 11-7 — puts generative and agentic AI expressly outside its scope, with separate guidance promised. That is a deferral rather than a dispensation: the duties attached to the action did not move, and the firm still has to say who authorised it. What it means practically is that nobody is going to hand you the agent-entitlement specification before that separate guidance lands.
Elsewhere the same question arrives through a different door. India's DPDP Rules make the data fiduciary accountable for processing carried out on its behalf, and purpose limitation there is a statutory test rather than a principle — so an agent identity with standing access across systems is an unbounded processing authorisation nobody consented to at that scope, and “the agent had the permission” is not an answer to it. In the Gulf, the CBUAE guidance note of February 2026 expects a documented governance framework and a risk-rated inventory with the governing body accountable for outcomes; accountability for an outcome is unworkable unless someone can name who granted the authority and produce the record. Three supervisors, three vocabularies, one artefact.
The inventory is smaller than you fear
The reason to do this first is that it is bounded, and the reason it gets deferred is that people imagine it is not. The relevant population is not every machine identity in the estate. It is the agentic subset — identities capable of multi-step action rather than executing a fixed integration — and in most enterprises today that is tens of things, not thousands. The distinction matters more than the total, because the agentic ones are the ones that will enumerate their own reach.
- Enumerate non-human identities from the sources that actually issue them — the identity provider, the cloud accounts, the secret stores, the platforms that ship agents inside them — and expect the union to exceed what any single system reports.
- Mark the agentic subset. One question separates them: can this thing choose a sequence of actions, or does it execute a fixed path? Everything that follows applies to the first list.
- For each agentic identity, write the four fields: the class of action it may take in business terms, the limits it operates within, the named human or governing body that granted it, and the date the grant expires. The technical part is trivial. The uncomfortable part is that most organisations have written down what a process is able to do and never what it is authorised to do.
- Give everything on the list a lifespan. Authority that never expires is authority nobody re-examines, and a timer is the only mechanism that forces the re-examination when everyone is busy.
That fourth step is what makes the other three hold. Without it the inventory is a snapshot that begins decaying the day it is signed off, which is how most inventories have historically failed.
The discomfort of writing the four fields is not a side effect of the exercise. It is the diagnostic. If nobody in the organisation is willing to put their name to what an agent may do, that is not a documentation gap to be chased down by a programme manager. That is the finding, arriving early enough to be cheap.
The first governable act
None of this is new thinking. Least privilege on machine accounts is not a 2026 insight, and the forty-five to one ratio has been reported for years — the industry's response has largely been to add it to a slide. What changed is that organisations deployed an actor with the patience to find every gap the old numbers described, gave it standing credentials because the delivery schedule required it, and pointed it at the functions with the broadest access in the building.
You cannot scope, monitor, or revoke what you have never enumerated. Every control above this one — enforcement at the point of action, attestation at execution, revocation under fire — is defined relative to a list somebody has to hold. Most organisations do not hold it, and the distance between having it and not is a fortnight of unglamorous work rather than a platform purchase. The agents are already running. The only question is whether the authority they exercise was granted by someone who can be named, or was simply lying around.
If you are about to run that enumeration and want a second pair of eyes on what counts as agentic and what the four fields should say, that is a conversation I have most weeks.