AI Is Its Own Identity Category

Often, the first AI agent in an environment gets set up the same way a service account does: an app registration, an API key, a technical owner. In the directory, nothing marks it as different. But only the agent decides what to do next.

In Series 2, I wrote that AI agents are the same identity problem at higher speed, with more autonomy and less margin for error. The autonomy is the part worth taking further, because it is why my book gives AI its own category.

It works with three kinds of identity: human, nonhuman, and AI. What separates AI from nonhuman is not how advanced it looks. It is inference and autonomy. Rule-based automation stays nonhuman, however sophisticated it is. An actor becomes AI the moment it reasons or acts on its own.

That difference changes how you govern it. The five pillars apply to AI the same as everything else, but what they ask for changes.

A service account follows the lifecycle of the application it serves. An agent follows the authority someone delegated to it.

A service account does the task it was built for. An agent chains tools and carries context from one task to the next. It needs clear boundaries on what it may and may not do, enforced in the systems it touches, because it will use whatever it is given.

A service account needs an owner. An agent needs an owner and a clear answer to whose authority it is using, and those are not always the same person.

When AI gets filed under nonhuman, the agent is governed like a service account: broad standing access, no end date, and nobody asking whose authority it is acting on.

Filing an agent in the wrong category breaks nothing on day one. It leaves a gap for the agent to find.

Setting the categories you govern by is a leader's call, and it is easier to make before agents arrive in volume.

Decide what makes something AI instead of nonhuman, and write it down.

Decide what every AI identity needs on day one: whose authority it uses, how it gets turned off, what it may and may not do, how its actions are logged, and an owner who answers for it. Most platforms cannot capture all of this yet, so record it at intake and hold vendors to it.

And make worker type a required field on every path an agent can come in through, whether an app request, a vendor review, or an AI review board, so an agent cannot come in looking like a service account.

I still see the job the same way: give people and machines the access they need to support the business. AI is part of who needs it now.

Related

• Series 2 Post 13: LinkedIn post
• Series 3 Post 4: LinkedIn post