Back Govinfosecurity

AI Agents Are Becoming Privileged Identities. Is IAM Ready?

Govinfosecurity • September 29, 2026

As AI agents gain access to enterprise applications, data and privileged systems, identity teams face a new challenge: How do you govern identities that can act autonomously and at machine speed?

In the latest "Proof of Concept," Melissa Carvalho, Vice President of Global Security Identity and Access Management at Royal Bank of Canada, and Gaurav Sharma, Vice President of Workforce Product Strategy at Ping Identity, how AI agents are reshaping identity governance, privileged access and accountability.

As NIST turns its attention to AI agent identity and authorization, organizations need to know which agents exist, who owns them, what they can access and whether they should be authorized to take a specific action at a specific moment.

"We really have to redefine what we think of privilege and how we manage privilege access for these agents, or for these accounts," Carvalho said.

Carvalho and Sharma joined ISMG's Anna Delaney and Tom Field to :

Why AI agents require new approaches to privileged access and least-privilege controls

How organizations can discover shadow agents and prioritize controls by the potential blast radius of a compromise

Why continuous monitoring, runtime authorization and rapid containment matter as agents gain autonomy

Don't miss our installments of "Proof of Concept," including the May 6 edition on crisis response and the May 7 edition on managing the aftermath of a breach.

Identity & Access Management

Privileged Access Management

Executive Director, Productions, ISMG

An experienced broadcast journalist, Delaney conducts interviews with senior cybersecurity leaders around the world. Previously, she was editor-in-chief of the website for The European Information Security Summit, or TEISS. Earlier, she worked at Levant TV and Resonance FM and served as a researcher at the BBC and ITV in their documentary and factual TV departments.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

AI Agents' Privileged Access Raises Security Concerns As AI agents increasingly gain access to enterprise systems, they are becoming privileged identities, posing new challenges for identity governance and access management. Organizations are urged to assess which AI agents exist, their access levels, and whether they should be authorized for specific actions. Experts from Royal Bank of Canada and Ping Identity emphasize the need for continuous monitoring and redefining privilege management for these agents. The National Institute of Standards and Technology (NIST) is focusing on AI agent identity and authorization, highlighting the importance of understanding the identity used by AI agents when executing actions. The risk of these agents collapsing traditional access control architectures is significant, as they can operate autonomously and at machine speed, potentially leading to insider threats. Current practices may overlook the access control issues associated with these agents, which could result in severe security incidents. 2 sources 51

Extracted Entities

Companies (1)

Royal Bank Of Canada