A Distinct Identity for Every Agent (Know Your Agent)

Only 21.9% of organizations treat AI agents as independent, identity-bearing entities in their security model. That number comes from Gravitee's State of AI Agent Security 2026, a survey of 900+ executives and technical practitioners published February 2026. The same survey found the average organization manages 37 agents, and that the most common agent-to-agent authentication methods are API keys (45.6%) and generic tokens (44.4%). Most agents, in other words, act in production under credentials that say nothing about what they are.

Under whose name does the work land? That is the first decision when you assign work to an agent. Get it wrong and every later control in this section, review gates, ownership, takeover, fails to attach, because the record cannot tell agent work from human work.

One caveat up front: Gravitee sells agentic IAM products, and the survey's methodology details are thin. Treat the precision skeptically.

A borrowed token erases the one distinction compliance needs

The borrowed-token model deserves its due. It is the simplest thing that works: run the agent under your GitHub token and every permission you have, it has. Nothing to provision, nothing to govern, and on a single laptop "the human at the keyboard" is a complete accountability story.

It stops working the moment a second person needs to read the record. When an agent commits with a human's token, the audit trail records a lie: it says a person did work a model did. The failures stack:

• No after-the-fact answer. Nobody can answer "was this AI-authored?" once the work is merged.
• No separate policy. Nobody can apply a different review policy to agent actions, because the actions are indistinguishable from the human's.
• No independent revocation. Nobody can revoke the agent's access without revoking the human's.

The five questions the laptop model collapses onto one person, starting with "whose identity is on this commit?", all reopen at once. Brex states the principle plainly in its autonomous-agents writeup: agent work "needs to be attributed back to an actual human and not just a bot." Both halves matter. The record must show a bot acted, and it must show which human is accountable.

The fix is a synthetic identity per agent

Every agent runs as its own principal, a synthetic "AI user," distinct from any human account. Its actions carry that identity through commits, PRs, tool calls, and logs, so human-authored and AI-authored are always distinguishable. The identity then binds to the human who initiated the task, which is its own problem with its own page: see binding to the human.

Two shipping systems show what this looks like:

• GitHub Copilot cloud agent. Commits as Copilot, with the developer who assigned the task marked as co-author. Pull requests opened by an automation are attributed to the user who created it, and, exactly as if that user had opened the PR themselves, they cannot approve it. The distinct identity is what preserves the required-approvals control; see author, never approver. The same docs note the friction: a ruleset that only allows specific commit authors will block Copilot entirely, covered in when branch protection blocks the bot.
• Microsoft Entra Agent ID. Treats agent identities as a platform primitive. Agents get purpose-built identity constructs with conditional access, risk detection, and lifecycle management, the same protections users and workloads get. Blueprints with parent-child relationships keep policy consistent across fleets, third-party agents from platforms like AWS Bedrock and n8n federate in, and all agent authentication and activity is logged for audit.

The market knows and hasn't moved

Gravitee's identity-treatment distribution is worth reading whole:

Nearly half the market is "planning," "partial," or "unsure," which in an audit reads the same as no. The surrounding numbers explain the urgency: 88% of organizations confirmed or suspected an agent security incident in the past year, only 47.1% of an organization's agents are actively monitored or secured on average, and only 23.7% use their existing IAM or IdP as the authorization server for MCP infrastructure.

Where the bar sits above the market

Two gaps separate the survey from the standard this handbook holds:

• "Identity-bearing" is undefined. The survey tells you who has agent identity but not what counts as having it; the term is self-reported, so the 21.9% is a ceiling, not a floor.
• Distinct is necessary, not sufficient. An AI identity scoped to the specific human who initiated each task is not fully met by any shipping platform today. Copilot's co-author convention and creator attribution are the closest mainstream approximation.

The distinct identity is step one; what it makes possible, queryable attribution for every change, is covered under the attribution property.