Managing AI Agent Identity at Scale: The Lifecycle Nobody Triggers

Gartner projects the average Fortune 500 organization will run more than one hundred fifty thousand agents by 2028, against fewer than fifteen in 2025. Thirteen percent of organizations believe their agent governance is adequate today. The management approach that works for fifteen agents is memory and a spreadsheet, and neither survives four orders of magnitude.

‍

The reason this scales badly is structural rather than a matter of effort. Human identity management works because a human resources system emits events, and every provisioning, review and deprovisioning workflow hangs off those events. Agent identities emit nothing when created and nothing when abandoned. Building the missing events is the work, and why agent identity matters at all covers the case for doing it.

‍

The Ratio Is Real and the Number Is Contested

‍

Published machine-to-human identity ratios for 2026 range from roughly seventeen to one at the low end to around one hundred forty-four to one in cloud-native environments, with figures of forty-five, eighty and one hundred to one appearing across vendor and analyst research. One dataset puts it at one hundred nine machine identities per human and attributes seventy-nine of those to AI agents specifically.

‍

The spread is wide enough that quoting a single figure is a mistake, and the reason is that counting methods differ on whether tokens, certificates, service accounts and ephemeral workload identities each count as one. The useful number is your own, produced by counting what authenticates in your environment rather than adopting a benchmark. Growth direction is consistent across every source, with agent identities projected to grow faster than either machine identities overall or human ones.

‍

Human Identity Works Because Someone Fires an Event

‍

Joiner, mover and leaver workflows function because a system of record announces each transition, and access provisioning, periodic review and offboarding all subscribe to those announcements. Remove the announcements and every downstream control loses its trigger.

‍

Creation Has No Trigger

‍

Research on enterprise identity indicates roughly two thirds of non-human accounts are created directly inside the application rather than through an identity platform, so the team responsible for governing identity never sees them appear. A developer provisions a service account during a build, a cloud platform auto-creates an identity object for a container, an agent registers its own credential. None of it reaches a review queue.

‍

Termination Has No Trigger Either

‍

The OWASP Non-Human Identities Top Ten names improper offboarding explicitly, and the mechanism is simple. When a project ends or an employee departs, the leaver's own access is revoked on schedule while everything they created continues authenticating. One 2026 identity dataset found eight hundred twenty-four thousand active accounts with no owner in any human resources system, about eight percent of identity provider users, all still holding live entitlements.

‍

Ownership Decays Faster Than Access

‍

Around half of organizations report no defined ownership of AI identities, and separate research found that nearly half of non-human identities had not changed in over a year. An access review reaching an identity with no named owner has nobody to ask, so the reviewer either approves it to empty the queue or escalates into a vacuum. Recording a human sponsor at creation is the only intervention that survives staff turnover, which is the same reason named ownership of AI risk matters more than the org chart it sits in.

‍

What Breaks First at Population Scale

‍

Three capabilities fail before anything else, and each one is measurable today rather than a future concern.

‍

• Revocation: Survey data indicates only around a third of organizations can revoke an AI agent's credentials at all.
• Attribution: Roughly a quarter can trace an agent's actions back to a human sponsor across every environment.
• Immutable Logging: Under a third hold tamper-evident records of what their agents did.

‍

Revocation is the one worth testing this week. Pick a deployed agent, attempt to revoke its credentials completely, and time it. Organizations discovering they cannot identify every credential the agent holds have learned something more useful than any maturity assessment would tell them, and attacker timelines make the answer urgent since exposed cloud credentials are commonly exploited within minutes while a quarter of organizations take over a day to rotate them.

‍

Building the Missing Lifecycle

‍

The fix is unglamorous and mostly consists of manufacturing the events that human identity gets for free.

‍

Registration at Creation

‍

An agent identity should not be able to authenticate before it exists in a register, which inverts the current default where it authenticates first and gets discovered later. Enforcement comes from the platform issuing credentials rather than from policy, since a policy requiring registration is a request. Where central issuance is impractical, discovery has to run continuously against what authenticates, and asset visibility determines whether the register describes the population or a subset of it.

‍

A Named Human Sponsor, Not a Team

‍

Every agent needs an individual accountable for its continued existence, and a team name fails the test because teams do not answer access reviews. The sponsor field also needs a link to the human resources record so that a departure produces a reassignment task rather than an orphan. Organizations doing only this one thing convert a silent accumulation into a visible queue.

‍

Expiry by Default

‍

Credentials that expire unless renewed reverse the accumulation problem, because an unattended identity disappears rather than persisting. Renewal requires the sponsor to confirm the agent is still needed, which is an access review that happens without a review cycle. The objection is operational risk from expiry, and the answer is that expiry dates are knowable and outages are schedulable while orphaned credentials are neither.

‍

Access Design That Survives Growth

‍

Lifecycle management controls how many identities exist. Access design controls what each one can do, and four patterns recur across cloud provider guidance and practitioner architecture.

‍

Stop Sharing Service Accounts

‍

Several agents authenticating as one identity destroys non-repudiation, so an investigation can establish that something happened and not which agent did it. Distinct identity per agent is the prerequisite for every other control on this list, and it is the change most likely to meet resistance because shared accounts are convenient.

‍

Carry Two Tokens, Not One

‍

An agent acting for a person should present its own machine identity alongside a downscoped token derived from that person's permissions, so the target system can enforce the narrower of the two. Single-token designs force a choice between an agent that can do everything any user can and an agent that cannot act on a user's behalf at all. Cloud providers have converged on variations of this pattern, and permission scoping is where the downscoping decision gets recorded.

‍

Zero Standing Privileges

‍

Long-lived keys are the asset attackers want and the asset prompt injection tries to extract, so short-lived credentials issued when a workflow starts and expiring when it ends remove the target rather than defending it. Research finding that a majority of secrets exposed years ago remain valid illustrates the alternative. Attribute-based rules combined with just-in-time issuance is the standard formulation.

‍

Enforce at the Target, Not the Agent

‍

An agent instructed to respect a boundary respects it until something goes wrong, while a database enforcing row-level security on the presented identity respects it regardless. Pushing enforcement to the resource means a compromised or confused agent cannot exceed what its token permits, which is the practical lesson from enterprises controlling agent sprawl.

‍

The Protocol Layer Adds Its Own Exposure

‍

Standardizing how agents reach tools reduces policy fragmentation across agent frameworks and introduces a new surface. Research on live Model Context Protocol servers found a substantial proportion running with no authentication whatsoever, and flaws in those tested that did implement authorization. Treating a protocol server as infrastructure requiring its own identity, scoping and monitoring is the correct posture, and the security implications of agents connecting to tools covers the mechanism.

‍

Agent framework supply chain deserves attention alongside it. Analysis of framework vulnerabilities found roughly a third involving identity, credential or access control flaws, putting framework version tracking inside the identity conversation rather than beside it.

‍

What to Measure

‍

Four numbers describe whether this is under control, and none requires a maturity model.

‍

Count identities with a named human sponsor as a proportion of the total. Count identities with an expiry date. Time a full revocation on a real agent. Count how many agent actions can be traced to a sponsoring human across every environment. Reporting those four each period turns an unbounded-sounding problem into a trend, and directors asking whether the position improved will accept a proportion moving in the right direction over an assurance that governance exists.

‍

Express the Exposure in Currency

‍

An identity population argument competes for budget against proposals stated in money. Modeled loss attributable to over-permissioned non-human access converts the count into a comparable figure, and AI risk quantification is what produces it. Nearly half of organizations already report breaches involving non-human identities, so the frequency input is not hypothetical.

‍

Manufacture the Events

‍

Agent identity at scale is not a harder version of user identity, it is user identity without the human resources system underneath it. Registration enforced at credential issuance, a named individual sponsor linked to a personnel record, and expiry by default reconstruct the three events every existing governance workflow assumes. Access design determines the damage each identity can do and lifecycle design determines how many of them nobody is watching. Kovrr's AI Security and Governance Platform maintains that population with owners and exposure attached, so the register is reviewable rather than archival.

‍

To see how many agent identities exist in your environment, who sponsors each one and what they can reach, book a demo mapped to your own estate.