Organisations already control access for employees and applications; AI agents now need the same attention, says Georgy Ovanesyan, CEO at Axidian.

A 2026 Cloud Security Alliance survey found that 74% of respondents said AI agents often receive more access than necessary. 

The tips below show how to control AI agents using familiar identity security principles, says Ovanesyan.

Give every agent an owner and a boundary: Record each agent’s task, the systems it connects to, and the person responsible for it. That person reviews its access regularly and withdraws it when the task ends.

Set two limits. Least privilege: the agent reaches only what its task needs. Least agency, in OWASP’s terms: the agent decides alone only what it should. An agent may propose a configuration change, but a person approves it before it is applied.

Make sure “off” means off: Switching off an agent does not cancel credentials it already holds. Rotate the secrets it used, and confirm that the systems which accepted them now refuse further requests. Revocation you haven’t tested is a hope, not a control.

Turn boundaries into enforceable controls: Identity security solutions can help put these boundaries into practice:

• IAM can manage agent identities, authentication, and application access.

• PAM and secrets management can protect privileged credentials and rotate them.

• ITDR can help detect compromised identities and suspicious access.

Do not wait for perfect tools: Organisations do not have to wait for perfect tools. They can extend existing identity controls to agents today. This provides a baseline alongside protection against AI-specific threats, tool execution risks, and data exposure.