AI agents are set to reshape how we all work together. Their promise is obvious. In the large, companies are starting to think about replacing entire customer service or fraud detection workflows with a fleet of agents. In the small, yesterday I asked my AI to place an Instacart order for me with a high-protein meal plan for the week, and it did it soup to nuts, and I didn’t have to click click click to get my groceries. It was glorious.
Anyone who starts to play around with agents can quickly see how this will reshape work. But you also very quickly realize that in order for agents to work in our organizations, we are going to need to invent a whole new identity framework.
The new third category, and we give them our passwords
Web authentication used to be simple. There are bots; those are bad. Keep them out. And there are humans; let them in. But now we have this third category. AI agents are a little like bots in that no human is running the keyboard, but they are also putatively working under the direct authorization and instructions of a human. So what do we do with them?
Today we’re solving this problem in the most clumsy way: we’re just handing our usernames and passwords over to our agents.
When I went to place that Instacart order with my agent, I first loaded the site in Claude in Chrome, then I logged into Instacart. And then I set Claude free to place my order. I went to get a coffee and came back 10 minutes later to my fully placed order.
For me, it worked great. But for the site, there was an important context switch they were likely not even aware of. My session started as human (me), but then changed to agentic (the third category) without anyone even telling them. So was this Instacart order placed by me, or my agent? They have no way to know.
This might be acceptable when the stakes are groceries.
But how do we deal with the risks when this pattern is used in our most sensitive corporate systems: the ones that grant access, change credentials, or change settings? Today’s workflows all rely on specific human action and a strong audit trail. But we just blew up both those things.
A New Identity Framework for Agents
Today’s agents piggyback on a human identity, either by taking over a browser session (as with my Instacart example) or with a durable OAuth token grant (such as when you use an MCP tool to connect Claude to your Gmail). In both cases, the agent is riding on the human’s own credentials, with no space between agent and human. This has to stop.
Our first principle is that agents must have their own identity.
This is an absolute requirement for the future of our industry for many reasons:
- Agents must have reputation. Just like there are good email senders and bad ones (spammers and scammers), there will be good and bad agents. We need to be able to tell the good agents from the scam agents. The only way to do this is to track their behavior, and the only way to do that is to tie their actions to an Agent Identity.
- Traceability. If we are looking at an audit log, we need to know whether an action was taken by a human or by an agent. Today that’s not possible. By giving agents their own identity, we make it possible.
- Different Scopes. Under today’s regime, when I ask an agent to work for me and let it use my accounts, it can do anything I can. For example, at my airline I can (a) see my itineraries, (b) book a ticket for me, (c) book a ticket for a stranger, and (d) give away my frequent flyer miles. I may be fine with my agent doing A and B, but no way do I want it to be able to do C or D. For that reason, we need to be able to delegate fine-grained permissions from human to agent. We need Agent Identity to do this.
- Revocability. Today, once an agent has access to my many accounts, it’s difficult to turn it off. I’d have to change my own password or revoke a series of auth tokens, and remember which I granted to the bad agent while leaving the good ones. What a mess. But if the agent had identity, we could just turn off that one agent.
You get the idea. We’d never consider letting humans operate without an identity, and we need to leave behind the idea that agents don’t need one.
Once we have this identity framework, we’ll need a way to track the reputation of agents. This is similar to what we do in marketplaces (seller reputation) or with Yelp. Good actors will get a good reputation, and news will quickly spread about bad actors.
Blocking of Credential Sharing
Some way or another, over time we will need continuous identity to detect when an agent has taken over a human session. For example, Instacart should know when the session transitioned from me to my agent.
My take is those events need to be blocked entirely. A human should not share credentials or a session with an agent. This is actually one of the most basic premises of cybersecurity: never share your credentials with anyone.
So the first thing we need is tools that can block those transitions. Many companies are at work on great tools here.
The second thing we need is a method for humans to grant access to agents. We have an established model for this in banking. In the early 2000s, the banking industry was beset on all sides by screen scrapers who would ask users to give them their usernames and passwords so the screen scrapers could download their data. But those credentials carried full permissions, including to transfer funds, so banks viewed this as a major security risk. In response, they invented the OAuth 2.0 protocol that many of us use today. If I want to use a budgeting tool with my bank, the budgeting tool redirects me to the bank’s own website, where the bank asks me if I want to let the budgeting tool in. If I say yes, the budgeting tool now has access.
This puts the bank in control. If they don’t trust this tool, they can turn it off en masse. They also can provide a UI for their customers to review all apps with access, revoke access, audit access, and so on.
We need the same approach for agents.
A New Dawn of Productivity
Agents are set to make us all more effective by giving everyone their own personal assistant. I am very excited about the ability for agents to remove drudge work from all our lives.
But this cannot happen the way we are doing it today. We need to build a new manageable identity framework. Once we have this in place, we will open incredible new capabilities.
About Peter Horadan
Peter Horadan is the CEO of Vouched, the AI identity verification platform that’s transforming how leading Healthcare and Financial Services companies onboard and verify people, instantly and securely. Throughout his career, Peter has led the charge in replacing slow, manual workflows with scalable, automated systems that unlock efficiency, reduce costs, and create measurable impact. From digitizing expense reporting at Concur to streamlining sales tax compliance at Avalara, Peter has helped modernize core business processes across industries. His leadership reflects a deep understanding of how automation can drive growth, compliance, and customer experience at scale. Peter has also held leadership positions at Scout Analytics, Microsoft, Corillian, and BEA Systems.
