AI agents: who controls their access?
AI agents call your APIs, read your data and act on behalf of your employees. Without IAM, they are invisible privileged accounts.
Copilots, business assistants, autonomous agents connected through the Model Context Protocol (MCP): generative AI has entered the information system through APIs. Every agent that reads a mailbox, queries a CRM or triggers a workflow is an identity. The question is no longer whether to govern it, but how.
The real risk: overly broad, never-reviewed permissions
In most deployments, the agent inherits a service account or an API key created “to move fast”. That secret often grants far more access than needed, never expires and never shows up in any access review.
Add prompt injection (a booby-trapped document that pushes the agent to exfiltrate data) and you get a privileged account steered by untrusted text.
Applying IAM fundamentals to agents
The standards already exist: they just need to be applied rigorously.
- A dedicated identity per agent, registered in the directory or IdP, with an identified business owner.
- OAuth 2.0 with delegation (token exchange, RFC 8693): the agent acts on behalf of the user, never with more rights than the user.
- Short-lived tokens and minimal scopes rather than permanent API keys.
- Fine-grained runtime authorization (ABAC, OPA) for sensitive actions, with human approval where needed.
- Full traceability: which agent, for which user, which action, on which data.
What about MCP?
The MCP specification relies on OAuth 2.1 to authorize clients against MCP servers. That is good news: your MCP servers can plug into your existing IdP (Entra ID, Okta, Keycloak, Ping…) instead of reinventing authentication.
We handle this in the field
- We inventory the agents and technical accounts used by AI across your information system.
- We connect your MCP servers and APIs to your IdP with OAuth 2.x and proper delegation.
- We bring these identities into your IGA access reviews and your PAM secrets vault.
Got a technical question on this topic? Our experts will be glad to help you find the answer.