How to Run an AI Agent Access Review: A Certification Checklist for Non-Human Identities
Palo Alto Networks' 2026 Identity Security Landscape reports that machine identities, including AI agents, outnumber human identities 109 to 1. Most access certification campaigns still cover only employees and contractors. That leaves the largest and fastest-growing population of identities with nobody asking whether its access is still needed.
Our LinkedIn article, Onboard an AI agent like a new hire, covers the full lifecycle. We have also written about the joiner, mover and leaver model for non-human identities. This post goes deep on one control: the access review.
Step 1: Scope the review
Pull agents from every place they are created: cloud AI platforms, low-code and automation tools, internal applications, and third-party AI tools with OAuth consent grants in Microsoft 365 or Google Workspace.
Start with agents that touch production data, customer data or financial systems. Lower-risk agents can follow in the next cycle.
Include the credentials behind each agent: API keys, service accounts, tokens and workload identities. The agent's effective access is everything those credentials can reach.
Step 2: Assemble the evidence for each agent
The named owner and the business sponsor.
The documented purpose, in one or two sentences.
Every entitlement, scope and role, with when each was granted.
Actual activity since the last review: which tools and systems it called, and on whose behalf.
Credential facts: type, storage location, age and last rotation.
Step 3: Ask the reviewer five questions
Is this agent still in use, and are you still its owner?
Does each entitlement match the purpose on record?
Was any access added since the last review without a change to its purpose?
Is any granted access unused in the activity data?
Are its credentials short-lived or vaulted with rotation, rather than long-lived keys in code or configuration?
Step 4: Act on the findings
Revoke unused and out-of-purpose access within a set window, not at the next cycle.
Suspend any agent without a confirmed owner until someone accepts it. An ownerless agent with live credentials is the non-human version of an orphaned account.
Retire agents that are no longer used: revoke tokens, rotate or delete keys, and remove app registrations and consent grants.
Record the decisions as audit evidence, the same way you do for human certifications.
When your platform cannot do it yet
Identity platforms are adding agent support, but coverage is uneven. Some can discover agents but not assign owners, and some can hold an owner but cannot include agents in certification campaigns. We extend SailPoint, Saviynt, Okta, Microsoft Entra ID and Idira (formerly CyberArk) with custom connectors and workflows, so agents are reviewed in the program you already run rather than in a spreadsheet.
Frequently asked questions
How often should AI agents be reviewed?
At least as often as privileged human access in your program, plus an event-driven review whenever an agent gets a new tool, a new data source or a new owner.
Who should review an AI agent's access?
The named owner, with the business sponsor as escalation. For agents that act on behalf of customers or touch regulated data, add a second reviewer from security or compliance.
Check your readiness in two minutes
Take our 10-question AI agent identity scorecard for an instant score across inventory, ownership, credentials, lifecycle and review. You can also work through our five-point AI agent readiness self-assessment. To get the inventory done for you, our Agent Identity Inventory is a fixed-fee sprint that finds the agents in your environment, assigns owners and scopes their access.
Built by the people who ran it.
Comments