AI agents are already acting alone inside companies: cybersecurity demands they get their own identity and a kill switch

By Zendoric · September 18, 2026.

An AI agent that chains calls across several applications, decides on the fly and does not ask permission at every step is, for any classic corporate security system, a problem with no category. That is the argument of an SC Media analysis based on a report by Martin Kuppinger, an analyst at the firm KuppingerCole, sponsored by the identity provider Ping Identity: the identity and access management (IAM) systems companies use to control who gets into which system take predictable behavior for granted. AI agents, which make probabilistic decisions and pursue dynamic, multi-step tasks, break that premise. What makes them useful —autonomy— is precisely what makes them hard to audit.

The proposal set out in the report applies the principles of 'zero trust' to agents, the security model that assumes no actor, human or software, should be considered trustworthy by default. In practice: each agent needs a unique and stable identity, a responsible human owner, an authorized purpose, a defined operational scope, a closed list of systems it can access and an expected lifespan. Without that, the report warns, an agent becomes a 'shadow resource' outside any governance. Credentials, moreover, should be short-lived and issued dynamically for each session or task, rather than persistent secrets that someone could steal and reuse indefinitely.

The second pillar is dynamic authorization. Kuppinger argues for policy-based access control (PBAC) over the classic role-based access control (RBAC) model: instead of assigning a fixed permission according to the agent's 'job', each action is evaluated in the moment according to the sensitivity of the data, the threat level, the scope of the task and the degree of autonomy involved. A low-risk read on a low-sensitivity system would be approved automatically; modifying financial records would require an additional check or a person's intervention. "Defining these levels explicitly, instead of assigning a single set of permissions to all agents, limits the potential damage from an agent that misbehaves or is compromised," Kuppinger writes.

The third element is traceability: every API call, every data access and every relevant decision should be recorded in an immutable log that captures not only what the agent did, but what it was asked to do and why. The report also insists on two safeguards that, it says, must sit outside the agent itself: systems and APIs must verify permissions on their own rather than trusting what the agent claims to have, and any deployment with production access needs a kill switch capable of suspending or terminating activity instantly. "The ability to stop an agent quickly is a basic operational requirement, not an advanced feature," Kuppinger sums up.

It is worth placing the piece in its exact context: it is signed by a custom content strategist at CyberRisk Alliance, SC Media's parent company, and it draws on a report paid for by an identity provider that sells precisely this type of solution. That does not invalidate the technical diagnosis —it is sensible and matches what other players in the sector say— but it is worth reading it knowing who signs the prescription and who sells it. It is the same exercise in skepticism we apply when Nvidia or OpenAI proclaim AGI thresholds: an interested party's claim is still useful, but it has to be separated from the marketing.

As sector context, this is not an isolated case. The day before, as SC Media itself links, Okta announced new identity governance features specific to AI agents, and another article in the publication warned of a wave of synthetic identities ('digital Frankensteins') sold on dark web forums for barely $200. The overall reading is clear: the entire identity management sector is repositioning itself in record time to build the 'plumbing' of agentic AI, in the same way that Google and Microsoft are competing to control the agent distribution layer against OpenAI and Anthropic. Whoever governs agents' identity and permissions will hold as much market power as whoever trains the most capable model.

Our reading is that this kind of infrastructure —tedious, unglamorous, not remotely viral— is exactly what decides whether the short-term risk of agentic AI is contained or spirals. We have already written about previous incidents with agents and about how agentic AI is industrializing fraud: in both cases the underlying problem was the lack of visibility into what an agent was doing and who answered for it. What this report proposes is, in essence, the missing scaffolding: identity, permissions that shift with risk, a record of every decision and a kill switch that actually works. Most organizations already deploying agents in production probably have none of this implemented yet, and that gap —between the speed of adoption and the maturity of governance— is the ground on which the next incidents will occur.

In the medium term, however, this is precisely the class of infrastructure that makes it possible to delegate weightier tasks —healthcare, finance, critical infrastructure— without giving up traceability or the ability to intervene. You do not reach the abundance we defend at Zendoric by blindly trusting autonomous agents, nor by demanding human approval on every click; you get there by giving them a framework in which autonomy can be audited, limited and revoked. Agents' identity and accountability are not a minor chapter in the AI conversation: they are the technical condition that separates an assistant that frees up human time from one that one day becomes, without anyone noticing in time, the source of an incident nobody can explain.