Walk into most enterprises a year into their AI experiments and ask a simple question: how many agents are running, who owns each one, and what is each allowed to do. The silence that follows is the problem. Agents got built quickly, often by different teams, often with broad credentials so they would "just work," and nobody kept a register. You cannot govern a population you cannot count, and you cannot count what was never named.
This is why agent identity is the foundation of agent governance. Not the most exciting part, but the part everything else stands on. Before you can decide whether an agent may take an action, there has to be a registered agent to decide about.
What it means to treat an agent as an identity
An identity is more than a name. When we say an agent should be a first-class identity, we mean it should carry the same attributes any governed actor carries.
It needs an owner: a specific human or team accountable for what it does. Ownership is what turns an abstract risk into someone's responsibility, and responsibility is what gets agents reviewed and retired instead of left running forever.
It needs an approved purpose: a clear statement of what the agent exists to do. Purpose is not decoration. It is the reference point policy uses to decide whether a given action is in bounds. An agent approved to triage support tickets has no business querying the compensation database, and a recorded purpose is what makes that judgment automatic rather than a debate.
It needs permissions scoped to that purpose. The default when building an agent is to grant broad access so development is frictionless. The default for a governed agent is the opposite: the narrowest set of data, models, and tools the purpose actually requires. Scoping to purpose is the agent-world expression of least privilege.
And it needs a lifecycle: created, active, updated, retired. Agents are not permanent fixtures. They are built for a need, they evolve, and eventually the need passes. Without a lifecycle, retired agents linger with live credentials, which is one of the quietest and most dangerous forms of risk.
Why this matters more for agents than for people
People change roles through a managed process. They are onboarded, their access is reviewed, and they are offboarded when they leave. Agents tend to skip all of that. They are spun up in an afternoon and forgotten, and because they are not people, no HR process ever flags them for review.
That asymmetry is exactly why agent identity has to be deliberate. The registry that tracks owner, framework, purpose, permissions, lifecycle state, and deployment environment is the thing that prevents agent sprawl from becoming an unmanaged attack surface. It is also what makes governance scalable, because policy can reason about a registered identity but cannot reason about an anonymous process. This connects directly to the broader practice of AI TRiSM, trust, risk, and security management for AI.
The registry is where governance becomes possible
Once agents are registered identities, the rest of agent governance has something to grip. Policy can be written against the agent's purpose. Permissions can be scoped and reviewed. Hand-offs between agents can be reasoned about, because both the sender and the receiver are known identities, which is the subject of the hand-off problem. And every action the agent takes can be attributed to a specific, accountable identity in the audit trail.
The lesson is unglamorous and worth repeating. The first step in controlling autonomous AI is not a clever runtime control. It is the discipline of never letting an agent reach production without an owner, a purpose, and a place in the registry. The full architecture that builds on this foundation is in the complete guide to agent governance and agent governance.