Your AI Agents Are Running Loose and Your IAM Stack Can’t See Them

Every enterprise security team thinks they know what’s on their network. They don’t — not anymore. The moment you let an agentic workflow call an API, you handed the keys to an entity that appears, acts, and vanishes faster than your provisioning system can blink. Two researchers just published a five-part framework for why your current controls are structurally broken — and the honest part is they admit one of the five pieces isn’t even wired up yet.

What happened

Oswal and Cadeddu argue that enterprise deployments of autonomous AI agents inherit an access-control model built for human users and long-lived services, and that model fails in exactly three ways: agent principals are ephemeral (they appear and disappear faster than provisioning pipelines can track); their actions are chosen by a model rather than programmed, so the action surface is unknown in advance; and the agent population is discovered, not provisioned — anyone who can call an API can create one. From these failure modes they derive five runtime primitives that must each be present: discovery, identity, governance, attestation, and supply chain. They describe an implementation where an agent’s action is mediated against policy before execution, authorized against a per-tenant action vocabulary, and logged in a hash-linked signed ledger verifiable by a third party with the vendor out of the loop. The architecture has real costs they don’t hide: the enforcement point sits on the critical path of every request, identity requires a sidecar per workload, and fail-closed mediation converts availability incidents into outright denial of service. Of the five primitives, four are built and running in private pilots; the fifth (supply chain) exists as separate tooling and is not yet integrated into the request path — and the authors explicitly note that a taxonomy that perfectly matches what its authors built “is not a taxonomy but a description of a codebase.”

Cold read

That last self-indictment is the most useful sentence in the paper, and it should give you pause. This is a position paper backed by a private-pilot implementation, not a peer-reviewed study with controlled comparison against alternative architectures — there are no benchmark numbers, no failure-rate statistics, no latency figures beyond “sits on the critical path.” The five primitives feel intuitive and well-reasoned, but the decomposition is essentially argued from first principles by the people selling the solution; independent validation that these five — and not four or seven — are the necessary and sufficient set is absent. The multi-agent orchestration problem they’re solving is real, but the hard case — cascading agent-to-agent calls where identity and governance must propagate across trust boundaries mid-chain — is described but not demonstrated. And “private pilots” is doing heavy lifting: we don’t know scale, we don’t know incident rates, and we don’t know whether enterprise customers are actually enforcing fail-closed or quietly switching to fail-open to preserve uptime.

What it means for you

• Signal maturity: 2/5 — Coherent framework, one primitive unintegrated, zero third-party validation
• Who gets hurt: Security and compliance teams at enterprises running agentic AI in production who assumed their existing IAM/RBAC stack was sufficient coverage for agent workloads
• What breaks if this is true: Every SOC 2 and ISO 27001 audit assumption about “known action surfaces” becomes fiction the moment you deploy an LLM-driven agent — your compliance posture has a gap you haven’t disclosed
• Why it might not land: Fail-closed mediation on the critical path is a non-starter for latency-sensitive products; operators will route around enforcement rather than absorb the availability risk, gutting the governance guarantee
• Watch for: A major cloud provider (AWS, Azure, GCP) shipping a native agent identity primitive — that’s the signal that the market has accepted the problem framing and the race to own the solution is real

Forecast as of 2026-08-28

By Q2 2027, at least one of the three hyperscalers will have shipped a generally available “agent identity” service (distinct from existing service accounts or managed identities) that maps directly to the discovery + identity primitives described here — or this framework will remain a vendor whitepaper that nobody operationalized at scale.

Source: Five Primitives for Governing Autonomous AI Agents at Runtime — Jiten Oswal, John Cadeddu. https://arxiv.org/abs/2608.26696v1