As with any major technology shift, the first generation of AI agents started as experiments – side projects, prototypes, or isolated automation efforts. But as enterprises began to see the potential, the deployment strategy shifted toward cloud-based agent architectures. Instead of running standalone chatbots or desktop tools, organisations are now building and hosting agents inside their trusted cloud environments, which helps to deploy solutions at scale. This strategy will not cover all types of agents, but it is a good start to measure the return on investment.

All major cloud providers now offer frameworks that make this possible. Microsoft Azure AI Foundry allows enterprises to build and deploy agents that leverage GPT models within their own tenant, using managed identity, Key Vault, and data loss prevention controls. AWS Bedrock provides a similar capability, hosting multiple foundation models while giving enterprises the ability to chain them into workflows using Lambda and Step Functions. Google’s Vertex AI Agent Builder and Gemini for Workspace extend the same idea into the Google Cloud ecosystem – allowing AI agents to interact securely with enterprise data and business processes while maintaining audit trails and compliance boundaries.

In these environments, the agent doesn’t run in isolation. It is integrated into cloud-native identity, policy, and telemetry systems, which means its actions can be authenticated, logged, and controlled just like any other workload or API client. This is where the parallels with identity security become critical: every agent must have an identity, a defined purpose, and least-privilege access to the systems it touches. The LLM or model itself might power the reasoning, but the cloud platform provides the policy perimeter – where permissions, context, and observability live. Additionally, even if the agent is built as a dedicated application, it will still need to connect to AI models deployed somewhere, especially if they have been fine-tuned with company-specific data, such as a master prompt. This also makes agent infrastructure discoverable, even when agents aren’t fully deployed within cloud-native frameworks.

As these architectures mature, we are starting to see multi-agent systems emerge inside enterprise ecosystems: one agent orchestrating customer support workflows, another handling internal IT triage, and others managing document processing or analytics. Each of these interacts through APIs, A2A protocols, and must be secured under the same governance frameworks that already protect human and machine accounts.

This is where SailPoint is leading the way with Agent Identity Security and Data Access Security. The discovery of AI Agent infrastructure and their access, the tools they use (like machine identities or service accounts), and their access provides multiple fundamental insights.

• What effective access does an agent get through interaction with the tools available to it?
• Who can interact with the agent and as a result, could become over-privileged due to the data the agent can expose to that person?
• Is there privileged data in the data set the agent has access to and who owns that data?

These fundamental insights are the start of any governance process that de-risks Agent adoption, limits any potential blast radius and provides companies with the tools to clean up data to a point that it is safe to use by the specific agent. This allows the business to apply governance procedures and automated access management, an approach that will help enterprises scale AI safely, turning the abstract promise of autonomous systems into controlled, auditable business value.

Many organisations are excited about agentic automation but stop short of production because the risks feel uncontrollable (Gartner, 2025). The blockers are practical and repeatable:

• Unknown attack surface: Agents often require broad, cross-system access (databases, CRMs, ticketing, cloud consoles). Without a clear inventory, teams fear silent exfiltration, destructive actions, or accidental privilege escalation.
• Lack of governance and ownership: Who signs off on an agent’s permissions? Who’s accountable if it misbehaves? Without baked-in ownership and lifecycle controls, security teams won’t greenlight deployments.
• Regulatory & compliance uncertainty: Agents that process PII, financials, or regulated data raise immediate legal questions. Organisations need auditable decision trails, not opaque agent behaviour.
• Operational fear of autonomy: Leaders worry about “agent runaway” scenarios (wrong automated changes, data corruption, deletion) where human oversight is too slow to stop damage. This is especially acute for workflows that modify production systems.
• Tooling and visibility gaps: Traditional IAM and observability tools weren’t designed for autonomous identities that can change behaviour rapidly; many organisations lack the telemetry and policy controls needed to detect agent misuse quickly.

Because of these gaps, many enterprises prefer limited automation in small parts of the process, orchestrated by manual interventions, or tightly constrained copilots rather than full autonomous workers – until they can treat agents as governed, auditable identities.

Bringing agents under control starts with treating them like first-class identities. SailPoint’s Agent Identity Security provides a pragmatic roadmap for that transition: discover agents across cloud platforms, register them as identities, attach business context, and enforce lifecycle governance. This is just the start of the journey, and the platform is evolving, but there are key capabilities and recommended actions we can do today:

• Automated discovery & inventory: Connect SailPoint to cloud providers and agent platforms to surface AI agents, service accounts, and associated keys. This converts hidden agents into manageable objects.
• Unique, verifiable identities: Register each agent with a dedicated identity (not shared credentials), enriched with owner, business purpose, and risk context. This enables accountability and traceability.
• Ownership & access certification: Assign one or multiple human owners who must certify the agent’s access and purpose. Automate periodic access reviews and revocations when roles change.
• Least-privilege & entitlement controls: Reduce blast radius by enforcing fine-grained entitlements and automated policy checks before provisioning agent access.
• Audit trails & revocation: Log agent actions centrally and maintain the ability to immediately revoke access when anomalous behaviour is detected.
• Cross-platform governance: Aggregate agents from AWS, Azure, Google and other systems into one governance plane so policy is consistent across cloud silos.

Implementing these steps lets organisations move from “fear” to “managed confidence” – agents can be deployed when they’re visible, owned, and auditable.

There is, however, one more aspect of how the market is evolving that deserves attention on its own. Data access governance was traditionally seen as detached from identity, but has been continuously getting closer to Identity Security, especially as we move to AI solutions which are powered by the data they have access to.

Generative models are probabilistic; sensible outputs rely on context. That same behaviour creates subtle data-exfiltration attack vectors. Consider, for example, what PII data exists in the data set? How would an agent know if there is consent to use that PII data? Who will authorise the use of that data or should it be removed?

Lack of controls here could lead to a contextual leakage attack — not a breach of credentials, but a logic path that reconstructs sensitive facts from allowed information.

Or, if you let an agent loose on stale data, say management meeting reports for the past 5 years, the model will learn from outdated decisions that have no more meaning and should not influence its results. How do you find stale data that you can safely remove from the data set?

Practical mitigations you can apply today:

• Data classification & policy mapping: Classify sensitive fields (salaries, PII, financial metrics) and map them to explicit agent policies. Block any agent queries that could combine non-sensitive public data with allowed internal values to reconstruct sensitive outputs.
• Least-privilege data access: Give agents only the minimal dataset they need (tokenised, partial views, synthetic substitutes where possible). Avoid exposing raw sensitive datasets to agents unless absolutely necessary and audited.
• Monitoring, anomaly detection & rapid revocation: Monitor unusual query patterns, high-volume aggregations, or attempts to chain multiple queries to reconstruct sensitive values; revoke agent access automatically on suspicious behaviour.
• Human-in-the-loop for high-risk answers: For any output that could materially affect compliance or privacy, require human sign-off before the result is actionable or persisted.

These controls form a layered defense: prevent direct exposure with policies and masking, detect coercion with monitoring and prompt-hardening, and limit damage with least-privilege and revocation. Combined with agent identity governance (discovery, ownership, access reviews), organisations can deploy agents while keeping sensitive data protected.

As agentic AI solutions mature, organisations should expect – and demand – more robust real-time monitoring, anomaly detection, and rapid access revocation. Capabilities such as tracking unusual query patterns, high-volume data aggregations, or attempts to chain queries for sensitive data reconstruction will become essential safeguards. Automated responses to suspicious behaviour will be critical to maintaining trust and compliance as agents become more deeply embedded in business processes.

While this article has focused on the foundational aspects of agent identity and data governance, it’s important to acknowledge that the landscape is rapidly evolving. Integration layers like the Model Context Protocol (MCP) and emerging alternatives present their own unique challenges and opportunities. Staying ahead will require ongoing vigilance, adaptability, and a commitment to continuous improvement in both technology and policy.

Ultimately, the successful adoption of agentic AI hinges on treating these programmes as strategic, enterprise-wide initiatives – never as isolated IT experiments. Identity Security specialists must take a leading role, ensuring that governance, accountability, and risk management are built into every phase of deployment. By doing so, organisations can unlock the transformative potential of autonomous agents while safeguarding their most valuable assets and maintaining the trust of stakeholders.