AI Agent Readiness Is an IAM Fundamentals Problem: A Five-Point Self-Assessment for 2026

Every major identity platform now ships something for AI agents. Microsoft Entra Agent ID, SailPoint Agentic Fabric, Okta for AI Agents, and Palo Alto Networks' Idira (formerly CyberArk) all reached the market in the first half of 2026, and the independent non-human identity vendors were largely absorbed into those platforms over the summer.

In our LinkedIn article on that consolidation, we argued that none of it fixes what is actually broken underneath. This post is the practical companion. It answers a narrower question that identity leaders keep asking us: how do we know whether our program is ready to govern agents at all?

Our answer is a five-point self-assessment. It takes an afternoon, it needs no new tooling, and the difficulty of answering each question is itself the finding.

Why agent readiness is not an agent problem

An AI agent does not arrive with its own access. It inherits access that already exists.

When an agent is connected to an existing service account, it receives every entitlement that account accumulated over its life. When it authenticates with a static API key, it carries that key's full reach. When it acts through a user's OAuth consent, it acts with that user's delegated authority, at machine speed, without the pauses a person would take.

That is why the numbers on agent risk read like numbers on identity hygiene. IBM's Cost of a Data Breach Report 2026 found that more than 20 percent of organizations reported a breach involving an AI model or application, and that 92 percent of organizations with an AI-related breach lacked proper access controls for their AI systems. The same report put the global average breach at $4.99 million, and breaches where attackers used AI at about $6 million.

Palo Alto Networks' 2026 Identity Security Landscape adds the denominator. Machine identities, including agents, now outnumber human identities 109 to 1, and 96 percent of respondents said human identities already operate with access far beyond what their roles require. At the Idira launch, Palo Alto also reported that 61 percent of privileged access requests are still fulfilled as standing privilege.

Agents do not create that exposure. They execute against it.

The five-point self-assessment

For each fundamental below, we give the question to answer, what "not ready," "partial," and "ready" look like in practice, and the evidence to pull. Score each one honestly. A partial counts as not ready for this exercise, because agents exploit the gap, not the average.

1. Inventory: do non-human identities count as identities?

The question: Can we produce one reconciled list of service accounts, API keys, OAuth applications, workload identities, and agents across our identity provider, cloud platforms, SaaS estate, and CI/CD pipelines?

• Not ready: Service accounts live in an engineer's spreadsheet. Cloud and SaaS identities are counted separately, if at all.

• Partial: The identity provider and Active Directory are inventoried. Cloud workload identities and app-local accounts are not.

• Ready: A single inventory refreshes on a schedule and flags new non-human identities within days of creation.

Evidence to pull: Count of non-human accounts by source, and the date each source was last reconciled. Orchid Security's May 2026 Identity Gap snapshot found that 67 percent of non-human accounts are created directly inside applications, outside the IAM program's view. If your inventory only reads the directory, assume it is missing most of the estate.

2. Ownership: does every non-human identity have a named human owner?

The question: For each non-human identity, which named person is accountable for whether its access is still appropriate? Not which team deployed it. Which person.

• Not ready: Owner fields are blank, list a distribution group, or name people who have left.

• Partial: Owners exist for privileged service accounts only.

• Ready: Every non-human identity has a primary and backup owner, and owner departure triggers reassignment automatically.

Evidence to pull: Percentage of non-human identities with a current, active owner. This is the control that makes every later control possible. An identity with no owner cannot be certified, scoped, or safely revoked, because nobody has standing to say no.

3. Lifecycle: is deprovisioning enforced at the entitlement level?

The question: When an account is disabled, do its entitlements in downstream systems go with it?

• Not ready: Offboarding disables the directory account. Application roles, database grants, and cloud permissions survive.

• Partial: Connected applications deprovision. Disconnected applications rely on tickets.

• Ready: Residual entitlements are measured and reported after every offboarding, human and non-human.

Evidence to pull: A sample of ten identities disabled in the last quarter, checked against three downstream systems each. Residual access found this way is the most common form of identity debt we see, and the hardest to spot from a directory view.

4. Standing privilege: is just-in-time the default?

The question: What share of privileged access is standing, and what share is granted on request with an expiry?

• Not ready: Privileged roles are permanently assigned. Service accounts hold administrative rights "so nothing breaks."

• Partial: Human administrators use just-in-time elevation. Service accounts and automation do not.

• Ready: Standing privilege is the documented exception, with a named justification and review date for each.

Evidence to pull: Count of permanently assigned privileged roles, split by human and non-human. An agent connected to a standing privileged credential turns every task it runs into a privileged session.

5. Evidence: can we prove control continuously?

The question: If an auditor or regulator asked today who could reach a sensitive system, and through which identities, could we answer from live data rather than last quarter's certification?

• Not ready: Evidence is assembled by hand during audit season.

• Partial: Certification campaigns run on schedule, but approval rates near 100 percent suggest rubber stamping.

• Ready: Access evidence, including agent activity attributable to a specific agent identity, is produced continuously.

Evidence to pull: Approval rate of your last certification campaign, and whether agent activity in logs can be distinguished from human activity. If every line was approved, the campaign produced a signature, not a review.

How to read your score

Zero to two ready: Agent governance is premature. Any agent platform you deploy will report on an estate you cannot reconcile, and its dashboards will describe your identity debt in high resolution without paying any of it down. Start with inventory and ownership.

Three or four ready: You can begin scoping agent access, but treat the missing fundamentals as blockers for production agents with write access or sensitive data access.

All five ready: You are ahead of most programs we assess. The work now is extending the same controls to agents as first-class identities: their own credentials, a human sponsor, task-scoped and short-lived access, and a kill switch.

A note on the regulatory calendar

Update, October 2026: Our LinkedIn article stated that the EU AI Act's high-risk obligations became enforceable on August 2, 2026. That date moved. The EU's Digital Omnibus on AI entered into force in July 2026 and deferred obligations for stand-alone high-risk systems (Annex III) to December 2, 2027, and for high-risk AI embedded in regulated products (Annex I) to August 2, 2028. General-purpose AI model obligations and most transparency duties stay on their original track.

The same pattern holds in the United States. The Department of War suspended CMMC Phase II on July 13, 2026, while DFARS 252.204-7012 and Phase I self-assessments remain in force. Deadlines are moving. The controls they will eventually test are not, and every one of them depends on the five fundamentals above.

What we would do first

Start with the debt, not the agents. Our Identity Debt Diagnostic is a fixed-fee engagement of one to two weeks. It inventories over-permissioned human and third-party identities, attributes ownership, surfaces residual access, and produces a prioritized remediation baseline. Non-human and agent exposure is flagged as indicative in this pass.

Then scope the agent layer. For organizations standardized on Microsoft Entra ID, we follow with an assessment of agent and workload access paths: which agents exist, which run on inherited service account credentials, what each can reach, and whether that access is scoped or standing.

We work across SailPoint, Okta, Microsoft Entra ID, Saviynt, Idira, BeyondTrust, and Ping Identity, and we build custom tooling on top of those platforms when a gap needs closing. The person on your statement of work is the engineer in your architecture review.

Schedule a free 30-minute IAM assessment call: identitylogicconsulting.com

IdentityLogic Consulting LLC is a practitioner-led identity engineering firm and a Woman-Owned and Minority-Owned Small Business headquartered in Arlington, Virginia.

Sources

• IBM, Cost of a Data Breach Report 2026 (released July 29, 2026)

• Palo Alto Networks, 2026 Identity Security Landscape

• Palo Alto Networks, Idira launch release, May 12, 2026

• Orchid Security, Identity Gap: 2026 Snapshot, May 2026

• European Union, Regulation (EU) 2026/1744 (Digital Omnibus on AI)

• U.S. Department of War, CMMC Reform memoranda, July 13, 2026