AI Agent Identity Assessment

Machine identities already outnumber human users many times over in numerous organizations. AI agents add a new class of identity that behaves in fundamentally different ways: agents request permissions at runtime, autonomously call tools and APIs, delegate tasks to sub-agents, and chain actions across dozens of systems. Most organizations have neither an inventory nor appropriate policies in place. They lack clearly defined ownership, lifecycle processes for creating and deleting agent identities, and technical guardrails to prevent overprivileged agents.

The AI Agent Identity Assessment provides transparency across the existing landscape of non-human identities and AI agents within three to four weeks, evaluates governance gaps, and delivers a reference architecture with assessed vendor options and a corresponding roadmap. This lays the foundation for addressing the topic proactively and in good time before external audits or reviews.

The assessment scope is jointly defined during the kick-off and includes up to two platforms or two cloud environments as well as up to four business units. Any extensions to the assessment scope will be agreed and charged separately.

Scope of Services:

Phase 1 – Discovery (Week 1)

During this phase, interviews are conducted with IT, security, and business departments. To assess the current state as accurately as possible, data and reports from directory services, cloud IAM, and secrets management systems are also reviewed.

The result is a structured inventory of non-human identities and AI agent identities within the defined assessment scope:

• Technical and service accounts
• API keys and secrets
• Workload identities
• AI agents
• Copilots
• Automations, including their integrations (such as MCP connections and platform agents in M365, Salesforce, ServiceNow, and cloud environments)

Phase 2 – Gap Analysis (Week 2)

This is followed by an assessment based on a proven governance model for agent identities across six dimensions:

• 1. Inventory and ownership
• 2. Lifecycle management (creation, modification, decommissioning)
• 3. Least privilege and scope of permissions
• 4. Authentication and secrets Hygiene
• 5. Logging and traceability of agent actions
• 6. Human-in-the-loop controls for critical operations

Each dimension is assessed using a four-level maturity model. The results are benchmarked against common market expectations for comparable organizations.

Phase 3 – Reference Architecture and Roadmap (Weeks 3–4)

A target architecture for agent identities is developed based on open standards such as OAuth 2.1, Token Exchange, fine-grained authorization, and the secure implementation of MCP and A2A communication.

Various implementation options are assessed, including established specialist solutions such as Auth0 for AI Agents and cidaas AI Agent Identity, as well as platform-native approaches. The vendor assessment is conducted neutrally. Any partnerships on our part are disclosed transparently. Based on the findings, a roadmap for the next 12 to 18 months is developed. The results are presented in a workshop with management and the architecture team.

Project Deliverables

At the end of the project, you will receive:

• An inventory of non-human identities and AI agents within the assessment scope, including classification and ownership status.
• A risk heatmap showing the identified governance gaps across the six assessment dimensions.
• A policy framework for the lifecycle of agent identities, covering creation, operation, and decommissioning, which can be incorporated into your internal policies.
• A reference architecture with neutrally assessed vendor options and an integration outline for the existing IAM landscape.
• A roadmap and management presentation with prioritized implementation steps for the next 12 to 18 months.

Would you like to learn more about the AI Agent Identity Assessment? Let us arrange a no-obligation conversation.