Key takeaways
- AI agents transform machine identity from a scale problem into a behavior problem. Enterprises need certificate lifecycle management as the foundation, then layer runtime authorization and behavioral controls to govern what identities can do in real-time, not just authenticate who they are.
- AI agents require continuous, signal-driven lifecycle management instead of episodic certificate operations (issue, rotate, revoke).
- Valid certificates authenticate identity but don’t authorize specific actions, creating a critical gap between proving who an agent is and controlling what it does.
- Unified platforms spanning cryptographic trust, identity governance, and behavioral enforcement eliminate the need for multiple siloed tools and custom integrations.
- The shift from episodic to continuous identity management requires moving from directory systems to real-time control systems.
- Organizations face immediate risk from agents already in production that have overprivileged access without corresponding security controls.
AI agents are forcing enterprises to rethink machine identity management. Traditional certificate lifecycle management followed a simple episodic rhythm: issue, rotate, revoke. This worked for static systems with defined boundaries.
But according to Gartner, by 2028, 33% of enterprise software applications will include agentic AI, up from less than 1% in 2024. These autonomous systems operate differently. They’re continuous, adaptive, and long-running. They chain actions across systems, make real-time decisions, and operate on behalf of users in ways traditional platforms weren’t designed to handle.
AppViewX CTO Kash Ivaturi shared his thoughts on how enterprises should approach machine identity management differently now that AI agents are part of core infrastructure. Building a machine identity foundation for AI governance becomes the prerequisite for secure agent deployments. To dive deeper into the conversation, watch the full interview with AppViewX CTO Kash Ivaturi.
AI agents require continuous lifecycle management
Traditional certificate lifecycle management is episodic by design. The model assumes you know when an identity is created, when it needs renewal, and when it should be revoked. That assumption breaks with AI agents.
Traditional lifecycle management, Ivaturi explains, is episodic: “Issue a certificate, rotate it, revoke it. That model assumes relatively static systems. AI agents don’t operate that way. They’re continuous, adaptive, and long-running.”
The shift requires moving from scheduled events to signal-driven operations. Instead of waiting for renewal dates, lifecycle management must respond to agent behavior in real-time:
- Immediate discovery when an agent spins up
- Automatic permission adjustment when risk profiles change
- Instant termination when compliance is violated
Real-time discovery replaces periodic onboarding
Ivaturi points to discovery as the foundational shift. Traditional systems depend on manual processes: HR tickets, IT credential creation, and multi-department approvals. This worked when identities appeared slowly.
AI agents deploy in minutes. By the time manual processes are completed, agents have already operated with temporary credentials.
The answer is continuous discovery. The platform detects new identities as they appear and maintains an always-current inventory without human intervention. Lifecycle management shifts from periodic review to continuous validation, with permissions verified based on the current context rather than quarterly schedules.
Cryptographic trust doesn’t answer the behavior question
A valid certificate proves that an identity is authentic. It doesn’t prove that identity should be allowed to take a specific action right now.
“Cryptography answers one question: Is this identity authentic?” Ivaturi notes. “It does not answer: Is this action appropriate? That second question is now the critical one.”
Traditional PKI stops at authentication. An agent with a valid certificate can act freely until expiration or revocation. The assumption: if the identity is valid, the actions are trustworthy.
AI agents break that assumption, creating a gap between proving identity and controlling behavior.
What runtime enforcement looks like
Closing the authentication-authorization gap requires enforcing policy at the moment of execution. Instead of granting broad permissions at authentication, each action gets evaluated against policy as it happens.
Ivaturi outlines what an effective machine identity platform must provide:
- Real-time policy evaluation for every agent action
- Dynamic least privilege that adjusts based on actual behavior
- Just-in-time access granted only when needed, revoked immediately after
- Active intervention to pause, step up, or terminate when risk changes
As Ivaturi emphasizes, “Enforcement is no longer passive logging. It becomes active control at the moment of task execution.”
Why unified platforms matter for agent governance
AppViewX built its foundation on certificate lifecycle management, PKI automation, and machine identity governance. The 2026 acquisition of identity security company EOS added the ability to control what agents actually do, not just verify who they are.
“When you combine them together, you get a full spectrum,” Ivaturi explains.
That spectrum spans three layers:
| Layer | What It Does | Why It Matters |
| Cryptographic Trust | Proves identities via certificates and PKI | Foundation for authentication, especially as 47-day certificate requirements demand automated lifecycle management |
| Identity Governance | Manages lifecycle and permissions | Ensures continuous validation |
| Behavioral Enforcement | Controls what identities can do | Prevents unauthorized actions |
Organizations need all three working together. Cryptographic trust without behavioral enforcement leaves agents operating with valid credentials but no control over actions. Behavioral enforcement without solid cryptographic foundations lacks the identity assurance needed for zero-trust architectures. As organizations implement PKI post-quantum readiness, unified platforms become critical for managing cryptographic transitions alongside identity governance.
The unified approach matters because identity challenges at this scale don’t fit in silos. Enterprises running AI agents alongside traditional workloads need a single control plane, not multiple vendors requiring custom integration.
“We’re moving from trust at issuance to trust throughout the tasks these agents perform,” Ivaturi notes. “That’s what enterprises need. Not another silo, but a unified trust and control plane.”
Post-quantum readiness tests the same foundation
Cryptographic trust, the bottom layer of that model, is facing its biggest change in decades. NIST has finalized its post-quantum standards, and governments across the G7, EU, and US have set 2030 to 2035 as deadlines to move critical systems to quantum-safe algorithms. The risk isn’t only future, either: attackers are already storing encrypted data now to crack later once quantum computers catch up.
For enterprises running AI agents, this is familiar ground. Agents authenticate with the same certificates and PKI a post-quantum migration has to find and replace, and they raise the stakes in three ways:
- Volume – Agents constantly create new identities to cover.
- Pace – Agents go live in minutes, too fast for manual swaps.
- Agility – Changing algorithms at scale needs automated policy.
The system that keeps agent identities current is the same one that carries you through the post-quantum transition. Treating them as one problem rather than two is what keeps either one manageable.
AppViewX delivers this unified approach across certificate management, identity governance, and behavioral enforcement.
Security organizations must evolve beyond workforce identity
Most enterprise security teams remain organized around workforce identity. IAM teams focus on employee access. Security operations monitor user behavior. Access review boards approve human permissions.
The entire structure assumes humans are the primary actors requiring governance.
That assumption no longer holds. Machine identities outnumber humans 82:1 in today’s enterprise environments. Implementing non-human identity best practices becomes essential as organizations navigate this fundamental shift.
The issue, Ivaturi observes, is that most security organizations remain structured around workforce identity: “Employees, SSO, access reviews. That model breaks when non-human actors outnumber humans, which is exactly where we are headed.” Securing non-human identities requires fundamental organizational restructuring.
The four shifts required
The evolution to entity governance requires four concrete organizational changes. As highlighted in the 2024 ESG non-human identity research, enterprises are recognizing these transformation requirements:
- From periodic to continuous discovery – HR-driven provisioning worked at human speed. Agents appear dynamically and need automatic discovery.
- From HR-centric to distributed ownership – When an agent is deployed, who owns its security posture? Clear ownership models prevent agents from becoming orphaned identities nobody monitors.
- From static entitlements to runtime authorization – Quarterly access reviews can’t keep pace with agents that request permissions dynamically.
- From user-only to entity-inclusive monitoring – Security operations need visibility into agent behavior alongside human activity.
The challenge of keeping inventories current
These changes reflect a fundamental reframe of what identity means in enterprise security.
“The shift is from identity as a directory problem to identity as a control system,” Ivaturi explains.
Directory-based identity stores records and manages groups. Control systems validate continuously, enforce in real-time, and adapt to changing conditions. The architecture mirrors process control in manufacturing: constant monitoring with automated intervention when parameters drift.
This changes the evaluation criteria for identity platforms. Organizations should assess continuous validation capabilities, not just inventory completeness. Real-time enforcement matters more than comprehensive logging. Machine identity management strategies become essential as PKI teams expand beyond traditional certificate lifecycle operations.
Why behavior matters more than scale
For over a decade, machine identity management focused on scale. How do you discover thousands of certificates? How do you automate renewal across distributed infrastructure?
Those challenges still exist, but AI agents introduce something fundamentally different.
“Machine identity has always been a scale problem,” Ivaturi notes. “AI agents turn that into a behavioral and autonomy problem.”
The difference is fundamental:
| Traditional Machine Identities | AI Agent Identities |
| Does one thing with a defined boundary | Chain actions across systems |
| Static, predictable behavior | Dynamic, adaptive decisions |
| Fixed permissions work | Permissions must adjust in real-time |
| Behavior patterns for detection | Unpredictable operation sequences |
This changes what “identity” means. It’s no longer just what the system is. It becomes what the system is allowed to do right now in this context. Static authentication gives way to dynamic authorization.
The urgency comes from deployment velocity. Organizations aren’t waiting to solve behavioral governance before deploying agents. The gap between deployment and governance creates immediate operational risk.
Agents are already deployed without governance
The most immediate risk isn’t that governance frameworks lag behind agent deployments. The real risk is operational: agents are running in production with real permissions and no corresponding control planes.
Ivaturi points out that agents are already operating in production “with real permissions but without corresponding control planes.”
This happens for practical reasons. When teams deploy agents, figuring out exact permissions takes time. Granting broad access gets the agent working immediately, even though it creates a security risk.
But once deployed, those agents take actions continuously at machine speed across multiple systems, potentially exposing sensitive data, accessing systems outside their intended scope, or violating compliance policies.
Three immediate operational risks
With 74% experiencing data breaches in the past year, the governance gap shows up in three places:
- Overprivileged access – Agents receive broader permissions than required because least-privilege is harder to implement than broad grants. An agent needing read access to one database gets admin credentials to avoid permission errors.
- Lack of runtime visibility – Security teams can’t see what agents are doing as it happens. Traditional logging captures individual events but misses behavioral patterns. By the time violations appear in reviews, they’ve been happening for months.
- No enforcement at the point of action – Controls exist at authentication (the agent gets credentials), but not at authorization. Once authenticated, the agent operates freely until credentials expire.
This isn’t theoretical risk, Ivaturi emphasizes, but operational risk: “Data exposure, unintended system access, and policy violations happening through identities that most security teams don’t even have inventory for.”
Building governance for agents already in production
Organizations can close operational gaps while agents continue running. The path forward is incremental, not all-or-nothing.
1. Start with discovery and inventory
You can’t govern what you can’t see. Deploy continuous discovery that detects agents as they appear, capturing what permissions they hold, which systems they access, and who owns them.
2. Right-size permissions incrementally
Audit actual agent behavior against granted permissions. Start with highest-risk agents: those touching sensitive data or operating across multiple systems. Reduce permissions to match actual usage rather than attempting to fix everything simultaneously.
3. Deploy runtime visibility before enforcement
Implement behavioral monitoring that captures action chains across systems, not just isolated events. Integrate this into existing SOC workflows so teams can baseline normal behavior and detect anomalies.
4. Build enforcement where risk is highest
Start enforcing policies for critical workflows: agents accessing financial data, modifying production systems, or operating with elevated privileges. Implement just-in-time access that grants permissions only when needed and intervention capabilities that can pause or terminate sessions when behavior deviates.
5. Establish clear ownership
Define who is responsible for each agent’s security posture and document who authorized its deployment. This accountability chain becomes critical when investigating incidents.
How AppViewX addresses AI agent security
As the IAM market reaches $65.7B by 2034, AppViewX delivers the capabilities needed to implement these steps. Recognized as a leader in non-human identity management by KuppingerCole, the platform provides continuous discovery across certificates, machines, and agents, maintaining an always-current inventory without manual intervention. Crypto-agility assessment capabilities provide readiness scoring and risk insights for cryptographic transitions.
For permission management, AppViewX enables dynamic credential issuance and just-in-time access based on actual agent behavior. Runtime authorization evaluates each action against policy as it happens, with intervention capabilities that can pause or terminate sessions when risk changes. As the most awarded vendor in machine identity management at RSA Conference 2024, AppViewX delivers proven capabilities across certificate lifecycle management and identity governance.
The unified approach means organizations don’t need separate tools for cryptographic trust, identity governance, and behavioral enforcement. This becomes critical as NIST post-quantum standards drive cryptographic transitions and federal cryptography guidance shapes enterprise security requirements. Organizations must address quantum cryptographic risks while building post-quantum cryptography readiness into their identity infrastructure.
AI agent identity requires continuous lifecycle management, runtime authorization, and immediate action on operational gaps. Security teams can’t wait for perfect frameworks while real risk accumulates in production.
Ready to secure your AI agents? AppViewX provides a unified platform for discovering, governing, and enforcing policies on machine and agent identities.
Tags
About the Author
