Why Legacy IGA Fails for AI Agents

Identity Governance and Administration (IGA) has been the backbone of enterprise access management for over two decades. IGA platforms have helped organizations answer fundamental questions: Who has access to what? Is that access appropriate? Can we prove it to auditors?

These platforms work well for what they were designed for: managing human identities anchored in HR systems, following predictable lifecycles, changing at human speed.

But the computing model has fundamentally changed. AI agents are now accessing enterprise systems, acting on behalf of users, and making autonomous decisions at machine speed. They're not the human employees that IGA was designed to govern. They're not even the static service accounts that IGA has awkwardly accommodated for years.

AI agents reason, decide, and act autonomously. They spawn subtasks and delegate to other agents. They access databases, call APIs, and trigger workflows without human approval at each step. They operate across system boundaries that IGA was never designed to span.

Legacy IGA platforms have no coherent model for governing them. And that's not a bug—it's a fundamental architectural mismatch.

The Joiner-Mover-Leaver Model Doesn't Apply

Traditional IGA is built around the joiner-mover-leaver (JML) lifecycle. An employee joins the company, HR creates a record, and provisioning workflows automatically grant access based on their role. When they transfer departments, their access is updated. When they leave, everything gets revoked.

This model assumes several things that don't hold for AI agents.

A canonical source of truth. Human identities flow from HR systems that own authoritative attributes: legal name, employee ID, manager, department, start date. AI agents have no equivalent. They're created by developers, spun up by orchestration platforms, instantiated by other agents. There's no "HR system for agents" that knows which agents exist, who owns them, or what they should be allowed to do.

Predictable lifecycle events. JML workflows trigger on hire, transfer, and termination events. But AI agents don't follow employment lifecycles. An agent might exist for milliseconds or months. It might spawn dozens of child agents during a single task. It might be versioned, forked, or deprecated without any formal "termination" event. The joiner-mover-leaver lifecycle of a human identity simply does not apply.

Human-speed change. IGA systems expect access changes to happen at organizational cadence—quarterly access reviews, annual recertifications, periodic audits. AI agents can be created, granted access, and complete their entire operational lifecycle between review cycles. By the time a quarterly certification campaign runs, thousands of agents may have come and gone without ever appearing in a review.

Forcing AI agents into human-oriented governance models introduces friction without clarity. It requires manual ownership assignments and review workflows that simply can't scale.

Access Certifications Become Meaningless

Access certification is supposed to be the safety net. Even if provisioning isn't perfect, periodic reviews catch inappropriate access and force remediation. Managers review their team's access, application owners certify who should have access to their systems, and auditors verify the process works.

For AI agents, this model collapses.

Reviewers lack context. When a manager certifies a human employee's access, they understand that person's job function. They can reason about whether access to the finance system makes sense for someone in marketing. But who certifies an AI agent's access? The developer who created it? The platform team that deployed it? The business owner whose process it automates? None of them may have visibility into what the agent actually does at runtime.

Review cadence can't keep pace. Periodic certifications—monthly or quarterly—cannot keep pace with continuous deployment changes. An agent's permissions might change dozens of times between reviews. The certification captures a snapshot that's outdated before the review even completes.

Rubber-stamping is inevitable. Certification fatigue is already a problem for human identities. Rubber-stamping, reviewer fatigue, and growing auditor skepticism plague access review campaigns. Add thousands of agent identities to the mix—identities that reviewers don't understand and can't evaluate—and the process becomes pure theater.

The result is that access certifications provide compliance documentation without actual governance. Auditors see completed campaigns. Attackers see unreviewed access.

Static Credentials Create Persistent Risk

Legacy IGA was designed for a world where credentials were managed separately from governance. The IGA platform tracks who should have access; other systems handle how that access is authenticated.

This separation creates dangerous gaps for AI agents.

Most AI agents authenticate using static credentials: API keys, service account passwords, long-lived tokens. The 2025 Verizon DBIR reveals that 88% of basic web application attacks involved stolen credentials—often as the first and only step in the attack.

When the ServiceNow BodySnatcher vulnerability was discovered, researchers found that AI agent channel providers shipped with the exact same secret across all ServiceNow instances. Anyone who knew or obtained the token could interact with the Virtual Agent API of any customer environment. This isn't an IGA failure in the traditional sense—but it illustrates how agent authentication operates entirely outside the governance model.

Delegation and Context Disappear

Perhaps the most fundamental gap is that IGA has no model for delegation chains or operational context.

When a user asks an AI agent to perform a task, that agent acts on the user's behalf. But legacy IGA doesn't track "on behalf of" relationships. It knows the agent has access to a system. It doesn't know why, for whom, or toward what goal.

This matters because AI agents don't just execute single actions. They decompose goals into subtasks, potentially delegating to other agents. Each hop in this delegation chain raises questions that IGA can't answer:

• On whose original authority is this agent acting?
• Did the user actually authorize this specific action?
• Can downstream systems verify the delegation was legitimate?
• What happens when an agent's interpretation of a goal diverges from user intent?

Agents differ from traditional applications in fundamental ways: they act on behalf of users with varying degrees of autonomy, operate within complex delegation chains where authority flows through multiple intermediate agents, and their capabilities evolve dynamically. Traditional IGA tracks static entitlements. Agent governance requires understanding dynamic authorization flows.

Emerging standards from the OpenID Foundation and IETF are beginning to address agent identity and delegation. But legacy IGA platforms weren't built to consume or enforce these protocols—and retrofitting them is not trivial.

What Agent Governance Actually Requires

The limitations of legacy IGA aren't bugs to be patched. They reflect architectural assumptions that don't hold for AI agents. What's needed is Agent Runtime Governance — a discipline built on different foundations.

Continuous validation, not periodic review. Agent access should be validated against actual usage patterns in real-time, not certified quarterly by reviewers who lack context. If an agent hasn't used a permission in weeks, that permission should be flagged or revoked automatically.

Runtime context, not static entitlements. Governance decisions must account for what the agent is actually doing, not just what it's theoretically allowed to do. An agent with database read access behaves very differently when querying aggregate statistics versus exfiltrating individual records.

Ephemeral credentials, not static secrets. Short-lived, context-aware credentials aligned with specific tasks minimize the blast radius of compromise. When an agent needs database access, it should receive temporary credentials scoped to that operation—not a standing service account with broad privileges.

Delegation chain verification. Every action should be traceable to an originating user authorization. Downstream systems should be able to verify that delegation was legitimate without trusting the agent's self-attestation.

Behavioral anomaly detection. Agent governance must include monitoring for behavioral deviations that indicate compromise or misconfiguration. Unlike human users, compromised agents rarely trigger traditional signals like unusual login times or locations.

The Path Forward

Gartner analysts have noted that the maturity of machine identity management for most organizations lags significantly behind human IAM, leading to increased security risks and compliance issues. This gap will only widen as agent adoption accelerates.

Organizations can't wait for legacy IGA vendors to retrofit agent capabilities onto architectures designed for human governance. Industry frameworks like the Cloud Security Alliance's Agentic AI IAM guidance provide direction, but the hard work of implementing agent-aware governance falls on security teams today.

The organizations that get this right will treat AI agent governance as a distinct discipline—not an extension of human IGA, but a parallel capability built on different assumptions:

• Identity and delegation security that tracks who authorized an agent and preserves that context through delegation chains—not JML workflows anchored to HR systems
• Dynamic authorization that evaluates what an agent is doing in real-time—not static role assignments reviewed quarterly
• Tool and integration governance that controls which capabilities agents can invoke—not just which systems users can access
• Runtime guardrails that constrain agent behavior continuously—not periodic certifications that rubber-stamp access
• Agent-native observability that captures decision chains and behavioral patterns—not traditional audit logs designed for human sessions
• Multi-agent trust boundaries that prevent privilege escalation across agent orchestrations—not network perimeters designed for human access patterns

The organizations that don't address these gaps will discover what industry analysts already predict: non-human identities as a top-three risk for CISOs, exploited through governance gaps that legacy tools were never designed to close.

AI agents are here. They're accessing your systems, acting on behalf of your users, and operating at machine speed. The question isn't whether to govern them—it's whether your governance model was built for this era or the last one.

Watchlight AI helps enterprises secure their AI agent deployments with Watchlight AI Beacon, the runtime governance control plane built for autonomous agents. If your IGA strategy doesn't account for AI agents, let's talk.