AI agents are moving into production faster than security teams can track them. They hold credentials, carry entitlements, and act on systems of record, yet most enterprises cannot say which agents are running, who owns them, or whether anyone can stop them. Gartner expects a typical Global Fortune 500 enterprise to run roughly 150,000 AI agents by 2028, up from fewer than 15 in 2025, while only 13% of organizations believe they have the right agent governance in place.
The core problem is that agents break the traditional identity model. They are dynamic, not static service accounts, and they can accumulate permissions over time without oversight. A simple prompt like “get all the data” can trigger a denial‑of‑service‑like overload, taking down critical applications without any malicious intent. Shadow AI is already widespread—one bank that claimed it had no agents was found running more than 4,000.
RSA Agent ID addresses these risks with three integrated modules. Discovery continuously scans endpoints, networks, and applications to find every agent—sanctioned or shadow—and registers each as a first‑class identity with a named owner, risk tier, and lifecycle state, linked to existing identity providers. Secure operates as an inline AI/MCP gateway that checks every tool call against policy at the tool and argument level, allowing, denying, or escalating high‑risk calls to the registered owner through an out‑of‑band, phishing‑resistant approval channel. Govern logs every governed action and maps the evidence to ten regulatory frameworks, streaming immutable logs to the customer’s SIEM for audit and compliance.
Human assurance replaces approval fatigue: a risk engine scores each action based on user behavior, action type, and data sensitivity; only those crossing a risk threshold go to a human for review. Delegated permissions are inherited, never expanded, preventing privilege‑escalation through agent chains.
Before granting more autonomy, organizations must discover, authorize, limit, and be able to kill their agents. RSA Agent ID’s Discover and Secure modules will be generally available November 16 2026, with Govern following in the first half of 2027.
#AI #AgentSecurity #IdentityGovernance #ZeroTrust #AIAgents #Compliance