AI agents are beginning to do far more than answer questions. They can access systems and data, act on behalf of users, and increasingly work with other agents to complete tasks.
That changes the security challenge.
Knowing an AI agent exists is important. But as agents become more autonomous, organisations also need to understand what those agents can access, what they are authorised to do, what they actually did, and whether that access can be removed when required.
At Okta's Identity Summit in Australia, Stephanie Barnett, Vice President, Presales APJ at Okta, explored these questions with Cheng Lim, Partner and AI Expert at King & Wood Mallesons, and Eddie Smith, Identity Strategist and co-founder of Versent.
Their discussion highlighted why AI agents can't simply be treated like human users or traditional machine identities. (Watch the full conversation below.)
From least privilege to ‘exact privilege’
Least privilege has long been a fundamental security principle: Give people only the access they need to do their jobs.
Smith pointed out that AI agents require an even more precise approach. "We're sending our agents on missions," he said. "So, we should have mission-based access control."
He describes this as "exact privilege" aligning an agent's access with the specific task it has been authorised to perform, instead of broad or standing permissions.
This is an important distinction. An AI agent isn't simply logging into a system. It may be acting on someone's behalf, interacting with multiple applications or APIs, making decisions, and potentially passing work to other agents.
For organisations, that means that knowing an agent's identity is only part of the equation. They also need to understand what the agent is allowed to do.
AI doesn't remove accountability
Giving work to an AI agent doesn't mean handing over accountability.
During the discussion, Lim explained that many Australian laws are technology neutral. From a legal perspective, an AI does not have its own legal personality, meaning organisations can't simply attribute responsibility to the agent when something goes wrong.
That makes traceability increasingly important.
Can an organisation establish which agent took an action? Who authorised it? On whose behalf was it acting? What did it access? And if another agent became involved, can that chain of activity still be traced?
As agents become more autonomous, being able to answer those questions will become increasingly important for security, governance and accountability.
Discovery is only the beginning
Organisations also face different challenges when it comes to knowing which agents are operating in their environment.
Barnett distinguished between rogue agents, the tools or agents introduced without the organisation knowing they are there, and unknown agents, such as forgotten scripts or integrations that remain long after their original purpose or owner has disappeared.
One creates a discovery problem. The other creates a lifecycle problem. Both matter.
Organisations need to know which agents exist, but they also need to know who owns them, what they can access, and when that access should be removed.
Barnett described the goal as an environment where every agent has a known identity, scoped permissions, an audit trail, and a kill switch.
Together, those controls allow organisations to answer these fundamental questions: Where are my agents? What can they access? What can they do?
As AI becomes more capable of acting autonomously, these questions will become increasingly important.
The challenge isn't simply finding AI agents. It's maintaining visibility and control over what they are allowed to do once they're inside the enterprise.
Securing the next identity frontier
AI agents require a new approach to security. By moving to exact privilege, maintaining strict traceability, and ensuring complete visibility, organisations can protect their systems while safely adopting autonomous technology.
For more insights, watch the full Identity Summit conversation.
