The prompt-injection incidents get the headlines, but the quieter structural risk of 2026 is identity. Every agent you deploy is a new non-human identity with credentials, and NHIs already dwarf your workforce — service accounts, workload identities, API keys, OAuth tokens, and now autonomous agents. Industry analyses this year put the ratio anywhere from 90:1 to 144:1, still climbing. The problem is not the count; it is that these identities sit outside the governance perimeter. They have no owner, no lifecycle, and no access review — the exact controls we consider table stakes for a human employee.
Why an agent is not just another service account
A service account does one job with a fixed scope. An agent has variable scope per task: the same agent may act for different users at different times, with different entitlements, through different delegation chains. That breaks the model where you grant an identity a static set of permissions and walk away. If the agent holds the union of everything it might ever need, a single injection or logic error operates with all of it. The authority has to move with the task, not sit in the credential.
The 2026 shift: stop asking whether the identity is valid and start asking whether this agent, acting for this user, may take this specific action right now — then issue a scoped, short-lived permit instead of standing privilege.
What the field is converging on
The guidance emerging across identity vendors and the Cloud Security Alliance's non-human-identity work is strikingly consistent. Privileged access management for agents means full discovery, zero standing privileges, just-in-time access, ruthless least privilege, secrets vaulting and rotation, and behavioral monitoring tuned to agents specifically: which tools and data an agent normally touches, and alerts when it reaches for something outside its approved task. In other words, the answer is not a better password for the bot. It is a decision made at the moment of action.
- Give the agent its own identity and credentials — not a shared human's token — so its actions are attributable and revocable.
- Preserve the delegation chain: keep the user's authority attached through every downstream action the agent takes, so scope never silently widens.
- Authorize per action, in context — this agent, this user, this resource, now — and issue a scoped, short-lived permit rather than granting standing access.
- Monitor for privilege expansion, unexpected tool use, and new data access, and fail closed when an action falls outside the approved task.
Where this maps to the gateway
This is the same pre-action authorization primitive that stops a successful prompt injection from reaching a dangerous tool call — reused for identity. At Intertrace the agent presents a runtime key, tenancy is derived from that key rather than trusted from a claim, and the tool call is evaluated before it executes against the resource, the arguments, and the delegated authority. Zero standing privilege falls out of the design: the agent holds no lasting entitlement, only the ability to request a scoped permit that the control plane can refuse. It is not a new product category so much as recognizing that agent identity and agent authorization are the same problem viewed from two sides.
Tenancy and scope are derived from the agent's runtime key at the gateway, not asserted by the caller — so one agent's authority can never resolve into another tenant's data.