Presented by JumpCloud
A comprehensive approach to securing identities in today’s workforce, both human and artificial.
Organizations typically have robust protocols in place for managing human identities. New hires undergo a formal onboarding process, receiving a defined role, entitlements, and a designated manager responsible for their access. When employees depart, their credentials are revoked, and access is terminated. This process is standard; every identity within your workforce needs to be identifiable, scoped, and accountable from entry to exit.
However, artificial intelligence (AI) agents have now joined these systems, engaging with platforms like Salesforce, managing tickets in Jira, provisioning infrastructure, handling financial transactions, and communicating on behalf of teams. In many ways, these AI agents are integral members of the workforce, yet they typically lack formal onboarding, a designated human owner, and are not properly off-boarded when their functions are no longer needed.
Recent research from JumpCloud indicated that non-human identities are more prevalent than human users in 83% of organizations, with only 21% having specific governance measures for these identities. The following framework aims to address this issue.
Stage 1: Identify every operating agent in your ecosystem
Effective governance begins with a complete inventory, which is often lacking in organizations. AI agents are deployed by various teams and individuals who have the necessary tools and motivation to act swiftly. Consequently, IT is left to manage governance post-deployment, often without a clear understanding of the entire scope of implementations.
This creates the phenomenon of Shadow AI: agents functioning in production environments without any formal acknowledgment, designated ownership, or a system in place to halt their operation should issues arise. Identifying your agent population must be an ongoing effort, rather than a singular audit. Develop an inventory covering all environments capable of hosting agents: cloud services, managed devices, SaaS integrations, and on-site systems. For each agent, document access levels, workflow impacts, and action triggers. This inventory will serve as the basis for the entire governance framework.
Stage 2: Formalize each agent as an identity with an assigned owner
Each agent that functions within your systems should be registered as a formal identity within your directory, mirroring the essential details assigned to employees: a specific purpose, an authorized action scope, and a human owner responsible for its conduct.
This architectural decision is crucial in differentiating organizations capable of governing their agents from those that are not. Properly registered agents can receive entitlements, adhere to conditional access policies, and be involved in access evaluations. In contrast, agents that exist merely as service account workarounds or API keys lack systematic governance.
Registration also addresses the issue of Zombie Agents: those that continue to operate despite no longer serving their original purpose. By ensuring every agent has an assigned owner accountable for its continued relevance, inactive agents will naturally lose access once that ownership lapses. This process facilitates offboarding seamlessly rather than requiring a reactive cleanup after a problem occurs.
Stage 3: Control agent access using the principles of least privilege and zero standing credentials
To perform their functions, registered agents require access, but this access should follow the principle of least privilege: each agent should have permissions specifically aligned with its defined purpose, with limitations on duration wherever possible and revocable upon any behavior change.
Permanently stored credentials pose continuous risks. Static API keys that remain unchanged are also a potential threat. Secure agent access management entails issuing temporary credentials for privileged actions, establishing workflows requiring human approval before agents can interact with sensitive systems, and having quick-acting emergency shutdown mechanisms.
For agents accessing privileged applications, SSH servers, or databases, credential shielding must be implemented: agents should be able to fulfill their tasks without exposing the underlying credentials to the systems they interact with. All privileged sessions should be monitored and available for review.
Stage 4: Continuously monitor agent activity, not just at launch
The initial three stages set up the necessary governance controls. However, governance is an ongoing commitment that ensures agents’ actions align with their authorized functions, allowing for corrections when discrepancies occur.
Logging every action undertaken by an agent is essential. Regular access reviews should assess whether an agent’s permissions remain appropriate for its current responsibilities. Anomalies in behavior must be detectable before evolving into incidents. When an agent’s purpose concludes, the revocation of access should follow established procedures rather than being a reactive action prompted by an issue.
Governance also includes maintaining an audit trail that clarifies accountability: what resources agents accessed, what actions they took, who authorized them, and the resulting outcomes. Organizations unable to reconstruct this chain for any agent are not effectively governing their agents. Instead, they simply deploy them while hoping for positive results.
The foundation supporting all phases
Successfully implementing each stage of this framework becomes significantly more challenging when the underlying IT environment is disjointed. Identity, access, device management, and security protocols spread across various systems create gaps in agent governance, often leading to inconsistent policy application across different areas.
JumpCloud’s findings reveal that organizations utilizing fully integrated IT setups are five times more likely to deploy agents in critical business processes compared to those relying on fragmented infrastructures. The ability to establish coherent control layers that enforce consistent policies for humans, devices, and agents determines whether governance can keep pace with AI advancements or fall behind.
This is the essence of Agentic IAM: governing human, device, and agent identities through a singular, coherent control system enables scalable execution of the aforementioned framework.
Securing all identities, whether human or not, forms the operational groundwork necessary for safe AI scaling. Organizations prioritizing this will not only minimize risks, but they will also broaden the incorporation of AI into diverse workflows, advancing swiftly and confidently with the assurance that all identities within their environments are recognized, governed, and accountable.
Greg Keller is a co-founder and CTO at JumpCloud.
This article was sponsored by JumpCloud and is marked accordingly.
