I just published a piece on why AI agents may create the next IAM problem.

Most IAM models were built for humans, service accounts, and predictable applications. But AI agents behave differently. They can retrieve data, call APIs, use tools, trigger workflows, and act across connected systems based on changing context.

That creates a messy question:

How do we govern an identity that does not just authenticate, but acts autonomously after access is granted?

In the blog, I covered:

AI agent identity management
Why traditional access control starts breaking down
Excessive agency across connected systems
Why agents need identity boundaries, not just permissions
How runtime visibility becomes critical for agentic AI security

Here’s the full post:
langprotect.hashnode.dev/ai-agent-identity-manage…

Curious how others are thinking about this. Should AI agents be treated like users, service accounts, or a completely new identity category?