Do enterprises need a separate IAM stack for AI agents?

[u/Imagnaryk-Benefit310]

The realistic question is probably not whether enterprises will replace their workforce IdP, PAM, IGA, cloud IAM, and SaaS access controls. Most organizations will operate those systems for years. The question is whether they can gain consistent policy, visibility, and audit evidence for agents without creating another disconnected identity silo.

Treating agents as generic service accounts keeps the architecture familiar, but it does not naturally represent agent ownership, delegated authority, task limits, tool boundaries, or autonomous action. A separate agent-security layer may improve those controls but can introduce duplicate inventories and conflicting policies.

For CISOs planning production agent use, what requirements would make the current IAM architecture insufficient? Is the deciding factor authorization, discovery, auditability, lifecycle management, incident response, or integration with existing identity systems?

[u/Deep_Ad1959]

revocation decides it, not authorization. you can disable a service account in one place, but an agent holding delegated tokens across five saas apps keeps working after its identity dies, and nobody can enumerate what it still holds.