Key Takeaways
- AI agents are moving from passive advisors to autonomous actors, creating a looming “100,000 Agent Problem” where agents may soon outnumber human employees.
- Treating agents as synthetic employees and giving them human‑style logins is a fundamental security mistake; agents have different lifecycles, trust models, and operational scopes.
- Legacy identity‑and‑access management (IAM) systems grant broad, role‑based privileges at login, which becomes a live, high‑frequency risk when agents act at machine speed.
- Effective agent governance requires:
- Continuous, runtime policy enforcement tied to each transaction, not a one‑time login grant.
- Discrete agent profiles with scoped credentials, a human manager, and clear accountability.
- Visibility into per‑agent cost and behavior, enabling clean de‑provisioning and spend tracking.
- Autonomy does not eliminate ownership; every agent must have a human manager who retains ultimate responsibility and can intervene on high‑impact actions.
- Organizations need purpose‑built agent‑centric security models—governance becomes a launchpad for innovation, not a brake.
The 100,000 Agent Problem: From Advisor to Action
The enterprise workforce is poised to double—not with people, but with AI agents. As these systems evolve from passive “Advisor Mode” (offering suggestions) to autonomous “Action Mode” (executing decisions), organizations will soon run more agents than human employees. This shift creates a new class of risk that traditional security approaches are ill‑equipped to handle.
Legacy IAM Treats Agents Like Synthetic Employees
Most security teams repeat the same error: they hand agents human logins and rely on existing identity‑and‑access management (IAM) tools as if agents were just another type of user. Vendors encourage this by marketing “comprehensive” identity solutions that bundle humans, machines, and agents together. Yet equating an agent with a human is as misguided as expecting a person to drink gasoline because both need fuel.
Why Agents Fundamentally Differ from Humans
Human governance is established long before a login: employment contracts, background checks, job titles, and reputations build trust over a career. Agents, by contrast, have lifecycles, not careers; they lack conscience and human judgment, executing commands at machine speed without hesitation or fear of reprimand. Trust for agents must be earned through continuous monitoring and verification, not through pre‑hire vetting.
Role Separation Breaks Down with Polyglot Agents
Separation of duties exists to reduce fraud and error—e.g., the person who creates a purchase order is not the one who approves it. Agents, however, are natural polyglots: a single model can navigate sales, finance, and fulfillment in one seamless flow. Granting an agent the full privileges of a “sales” role plus an “accounts‑payable” role (as legacy IAM would do) gives it far more access than needed, violating the principle of least privilege and opening broad attack surfaces.
Identity Stops at the Door: The Login‑Only Handshake
Traditional IAM works like a checkpoint: at login, the identity provider (IdP) passes a group to the application, which then grants the associated permissions. After that point, the IdP sits idle; it does not inspect ongoing API calls or transactions. For a human clicking through a UI, the blast radius of a mistake is limited by human speed. An agent removes that boundary—it can act thousands of times per second, around the clock, turning a latent privilege risk into a live, continuous exposure.
Continuous Runtime Risk Amplifies Privilege Misuse
Because agents operate at computational speed and never tire, any over‑privileged credential is exercised repeatedly and rapidly. A mistaken permission that a human might use once a day becomes a threat that executes hundreds or thousands of times while no one watches. The traditional “least privilege” model—privilege inherited from a static human role—fails here; privilege must be scoped to the exact transaction and tools required, nothing more.
Redefining Least Privilege for Transaction‑Scoped Access
Effective agent security means granting privileges that are tightly bound to each specific action: the precise API call, the data set, and the time window. Permissions are evaluated continuously, not granted once at login and then forgotten. This shift turns security from a static gate into a dynamic policy engine that can approve, deny, or revoke access in real time as the agent’s workload evolves.
Introducing AgentProfile: A Purpose‑Built Record
To meet these needs, we created AgentProfile—a discrete record for every agent. Each profile includes: a unique identifier, a designated human manager, and credentials scoped strictly to the agent’s job requirements, independent of any human’s roles. Three core changes result when governance binds to the agent rather than borrowing from a person:
- Continuous runtime enforcement – policy is applied to every transaction, not just at login.
- Consolidated context – every model invocation and tool call maps back to a single record, enabling swift, global de‑provisioning when misbehavior is detected.
- Visible cost and performance – every call logs to a specific agent, allowing organizations to measure spend, efficiency, and ROI per agent instead of losing data in pooled accounts.
Autonomy Does Not Cancel Ownership: Human Oversight Remains Essential
Agent autonomy does not remove human responsibility. Every agent must have a manager who carries ultimate accountability for its actions—much like a director owns the outcomes of their team. High‑impact decisions (e.g., large refunds, non‑standard contract terms, production changes) should route to a human for approval before execution, preserving the same checks and balances that govern human employees. The agent runs independently most of the time, pulling in a human only at the moments that matter.
Governance as a Launchpad, Not a Brake
Every major software shift has demanded its own security model. Retrofitting human‑centric IAM tools for digital workers creates friction and leaves critical gaps. By adopting purpose‑built agent governance—continuous, transaction‑level policies, discrete AgentProfiles, and clear human oversight—organizations transform security from a hindrance into an enabler. This approach lets enterprises safely harness the speed and scale of AI agents while maintaining control, accountability, and trust.
Oren Michels is Co‑Founder and Chief Executive Officer of barndoor.ai, where he leads strategy, vision, and execution for its enterprise AI governance and agent control plane platform. He previously co‑founded Mashery (acquired by Intel), has built and scaled multiple enterprise software companies, and is an investor, advisor, and Tony‑nominated Broadway producer.