Seventy percent of organizations grant their AI systems more privileges than they would give a human employee performing the exact same job. And nearly one in five gives them significantly more. (That’s from our 2026 Infrastructure Identity Survey.)
What’s worse is that most organizations don’t even realize it’s happening.
[Text Wrapping Break]Agents aren’t demanding broad just-in-time privileges. They are not filing tickets requesting elevated privileges for an autonomous system. They are given these privileges gradually, over time, by humans, and it happens because the path of least resistance is to give an agent whatever it needs to be useful and deliver value faster.
A development team deploys an agent to help with incident triage. It needs access to logs, metrics, and alerting systems. It then needs access to the codebase to correlate changes and to production databases to verify the state. Each step is individually reasonable. Collectively, you’ve created a non-deterministic actor with broader access than any individual engineer on the team. And unlike that engineer, it operates continuously, at machine speed, without fatigue.
This pattern repeats across every organization deploying AI to production infrastructure. ChatOps agents inherit access to every channel they’re added to. Compliance automation agents get readaccess across entire environments. Code review agents can see every repository. The permissions accumulate, and because agents don’t log off, they never expire.
The Human Model Doesn’t Apply
The instinct to govern AI the way we do humans is understandable. But it’s also wrong.
Humans operate within natural constraints. They work during defined hours. They access systems one at a time. They exercise judgment about what they should and shouldn’t do, even when their credentials technically allow it. And when they leave the organization, someone revokes their access.
Agents share none of these constraints. They operate 24/7, across multiple systems simultaneously, making non-deterministic decisions about how to accomplish their objectives. They don’t have judgment in the human sense. They have permissions that define the blast radius of anything that goes wrong.
Teleport’s research shows a 4.5x difference between organizations that enforce least privileged access for agents (17% incident rate) and those with overprivileged agentic actors (76% incident rate). This is the single most predictive factor for AI-related security incidents we found. More predictive than industry, maturity level or stated confidence.
Confidence Is Not a Control
Here’s the paradox. Organizations that report the highest confidence in their AI deployments experience more than double the incident rate of those with lower confidence. Confidence, it turns out, correlates with complexity: with having deployed more agents, across more systems, with more access. It doesn’t correlate with having contained them.
Two-thirds (67%) of organizations still rely on static credentials for AI systems, such as passwords, API keys and other forms of long-lived secrets. These are credentials that persist indefinitely, get embedded in workflows and configuration files, and create exactly the kind of invisible, perpetual over-privileging.
When an agent has a static API key that never expires, sharing that key with another agent seems like the easiest thing to do. There’s no friction or moment when someone has to actively decide whether these two agents, with a shared credential, may diverge in intent, behavior and capabilities over time. The key already works, so the privilege sprawl grows.
This is why 43% of organizations report that AI makes infrastructure changes without human oversight at least monthly. And 7% don’t know how often it happens. You can’t govern what you can’t see, and you can’t see what isn’t tied to a verifiable identity.
The Identity Problem Underneath
Permission creep is a symptom. The root cause is identity fragmentation.
Most organizations manage human identity, machine identity, and now AI identity through completely separate systems, even though each was built on assumptions that AI agents completely violate.
Human identity systems were designed for users who are curious and non-deterministic, but ultimately slow. They work business hours and access one system at a time. They forget passwords and call the help desk. The entire architecture (SSO, MFA, PAM) is optimized around the assumption that the actor on the other side is a person, operating at a human pace, with human judgment filling the gaps that policy can’t anticipate.
Non-human identity systems, such as service accounts, API keys or certificates, were designed for the opposite: machines that are simple, predictable and fast. The classic service account is boring by design. It does one thing. You know exactly what it’s going to do because it was built to be fully knowable.
Agents are neither. They’re fast like machines yet error-prone and non-deterministic like humans. They operate at a scale that neither identity model was built to support, because when you add AI to an organization, you’re not adding one or two agents, you’re potentially adding thousands, each behaving in ways that shift as the underlying model is updated. Most existing identity solutions are simply not going to survive this transition, not because they were built badly, but because they were built for a world with two kinds of actors. There are now three.
When identity is fragmented this way, there’s no single place to answer basic questions like: What can this agent access? Why does it have that access? When was it last used? What happens if I revoke it right now?
Without those answers, least privilege is aspirational at best. You can write policies all day, but if the identity layer underneath is fragmented, enforcement will always be inconsistent. This is why retrofitting legacy IAM and PAM tools for AI fails. Those tools were built on assumptions that no longer hold: that identities are either human or machine, that access is relatively static, that credentials are long-lived, that behavior is predictable, and that sessions are discrete and auditable. AI agents violate every one of those assumptions.
Here’s What Needs to Change
The fix isn’t a new “agentic identity” category bolted onto the side. That’s just more fragmentation, and identity should never be fragmented by type. You don’t need a new identity silo, and you already have more roles than you have employees. Do you want to end up with more “agentic roles” than you have agents?
Every actor in your infrastructure, whether human, machine, workload or AI agent, needs to be the same and operate as a first-class identity within a single layer. Not separate systems stitched together. One layer, with consistent policy, enforcement and visibility.
That means every agent gets its own identity from the moment it’s created, the same identity type as the machine it runs on, the same as the human who authorized it, and the same as the human’slaptop. No shared credentials or borrowed human accounts. No ambiguity about which agent performed which action.
Access should be short-lived and task-scoped. When the task is complete, the privileges expire. No keys sitting in configuration files waiting to be exploited. If an agent needs privileges again, it earnsthem again, verified against policy in real time. Not after a ticket. Not after a review cycle. Now.
It means full auditability, where every action is attributed to a specific, verified identity. Not a generic service account. Not an alias behind a localhost email. A cryptographically distinct actor whose behavior can be traced, investigated, and, if necessary, terminated instantly.
And it means the ability to revoke privileges at machine speed. When an agent begins operating outside policy, deviating from what’s expected, you need to be able to automatically terminate sessions and permissions across every system it touches, immediately. Again, not after a ticket, and not after a review cycle. Now.
The Identity Question Every Organization Should Be Asking
The rapidly increasing complexity of computing infrastructure has been putting immense pressure on identity management for years. Most organizations have more groups and roles than employees. Deploying non-deterministically behaving agents on top of this mess comes with unpleasant consequences.
Nearly four out of five (79%) organizations are already evaluating or deploying agentic AI. Meanwhile, only 13% feel extremely prepared for the security implications. That gap between deployment urgency and identity readiness is where the risk lives.
The question isn’t whether your agents have more access than your employees. The data says they almost certainly do. The question is whether your identity infrastructure can do anything about it.
If identity is fragmented, the answer is no. If every agent operates as a first-class identity within a unified infrastructure identity layer (verified, scoped, auditable and revocable), the answer changes. You don’t just reduce risk. You gain the ability to deploy AI with confidence that’s actually earned, not assumed.
Ultimately, it’s not the AI that’s unsafe. It’s the privileges we’re giving it.
