The Agentic Reckoning: Why Enterprise Identity Must Evolve Beyond the User

For decades, enterprise security has been built on a fundamentally static model: define who can access what, assign roles and permissions, and trust that those definitions hold. The work of security was largely designing the right access controls, provisioning the right roles, and periodically reviewing whether those entitlements still made sense.

AI agents have exposed the critical limitation of that assumption. An agent doesn't operate within predefined, static boundaries. It reasons across systems, chains actions dynamically, and makes real-time decisions about what to access and when, operating in a context that no static access definition could fully anticipate. The enterprise security challenge is no longer only about governing who can access what. It is about governing what is actually happening, action by action, in real time.

Our research shows that 96% of organizations face significant challenges scaling AI across the enterprise — the reason is not a lack of effort — it is a structural mismatch. We are running a 21st-century autonomous workforce on a 20th-century identity model.

The scale is already here

This is not a problem to prepare for. It is a problem already running inside your environment. According to the Linux Foundation's "2026 State of Tech Talent Report," AI security concerns have surged from 17% in 2024 to 48% in 2026 — a critical shift given that 97% of organizations are committed to implementing AI.
Most cannot answer two basic questions about their own infrastructure: how many agents are running, and what systems can they access?

As NSA and other cybersecurity bodies have warned, the rapid proliferation of autonomous agents has outpaced traditional security models. AI agents — systems that reason, plan and execute at machine speed — are now operating across our most sensitive data environments.

"The biggest mistake organizations can make is thinking AI security is only about securing the model. The real challenge is governing everything the model touches. Agentic security can't start and stop with prompt injection defenses. It requires rethinking permissions, delegation, and how you constrain exploratory agents before they produce unintended side effects that ripple across the enterprise."

Allowing AI agents to blindly inherit the human's identity exposes a large attack surface. This is the "Confused Deputy" problem amplified to enterprise scale. If we do not evolve our identity plane to treat agents as top-level principals, we aren't just missing vulnerabilities — we are structurally ceding control of our digital estate to systems we cannot identify, govern, audit or scope.

Three pillars of the agentic identity model

Agents should never become proxies for humans. They must act within a bounded scope of authority that can be granted, audited and revoked. Every agent — whether acting autonomously under its own authority, or on behalf of a user — needs what any accountable actor requires: a distinct identity and an auditable trail of actions. For agents acting on behalf of a user, the unifying principle is simple: delegation, not impersonation.

1. Attribution — Know exactly which agent acted

You cannot govern what you cannot observe. The first requirement is that every agentic action carries a distinct, observable signal that identifies the agent as an actor — separate from the human it may be serving.

This matters because not all agents are the same. Autonomous agents operate independently as backend services and require explicit accountable identity. Delegated agents act on behalf of a user, borrowing their context to complete a task. Both require distinct identity, but for different reasons: the autonomous agent must be accountable as an independent actor; the delegated agent must be clearly distinguished from the user so that neither the user's full privileges nor their accountability is silently assumed.

Attribution also requires an organizational answer: every agent needs a named human owner — someone accountable for its actions, whose authority it borrows, and who must periodically audit and attest that its access still makes sense.

2. Authority — Scope access to intent, not just identity

When an agent fully inherits a user's identity and privileges, every agent compromise becomes a user compromise. OWASP's Excessive Agency (LLM08) identifies this as one of the defining failure modes of agentic systems: a blast radius determined by the agent's granted permissions, not by what the task actually required.

Traditional static roles are insufficient for agents whose privilege requirements vary by task. Access should be determined not just by who the agent is, but by what it is trying to accomplish — the intent behind the request. A well-governed system should be smart enough to downscope an agent's access to the minimum required by the task at hand, including applying appropriate protections for sensitive data the agent may encounter along the way.

Critically, agents should not be able to break out of that defined boundary. If that scope is compromised, the attacker is contained within it. Modern enterprise access must evolve beyond evaluating user permissions to enforcing runtime agentic boundaries. You must ask whether the specific agent, acting on this specific intent, is permitted to do it. The delegation must be explicit, auditable and breakout-proof — or it is not delegation; it's a security vulnerability.

3. Policy — Enforce what agents can do, continuously

Agents can be manipulated mid-execution — through prompt injection attacks that override system instructions, through credential abuse or simply through misconfiguration that lets an agent drift beyond its intended purpose. An agent that was provisioned correctly can still be weaponized after the fact.

The third pillar is continuous runtime policy enforcement, which moves security from setup to runtime. The organization's rules about what agents can and cannot do must be active at runtime. Real-time enforcement should monitor agent behavior against declared intent — designed to detect anomalies and flag threats, instead of relying on post-incident audits.

How Snowflake builds this in

• Learn more about how Snowflake is building these principles into the platform — from agent identity and session-scoped access to runtime detection and ecosystem governance
• Explore Snowflake's Agent Identity capabilities directly in our documentation.

The agentic era is moving fast, and the right security foundation looks different for every organization. If you're working through how to govern agents in your environment — what scenarios you're facing, what gaps you're hitting, what your use cases require — we want to hear from you. Reach out to us here or your account team. The security model for agentic AI will be built with practitioners, not just for them.