AI Agent Identity Is Built on Broken Service Account Hygiene

The article details how a recent NIST draft, released in February 2026 and closed for comment on April 2 2026, proposes extending OAuth 2.0 and policy‑based access controls to autonomous software agents. The draft stresses two core needs: uniquely identifying each agent separate from human users, and ensuring every action can be traced back to a specific agent and its human owner. In practice, firms still rely on legacy service accounts—often created with broad privileges and left unattended for years. Real‑world anecdotes, such as a forgotten Windows scheduled task running under a domain‑admin account, illustrate how migrations force teams to finally inventory these hidden credentials, then spend weeks tightening permissions to something justifiable.

The push to formalise AI‑agent identity mirrors a broader industry pattern where new technology layers are built atop legacy security foundations. A 2026 Gravitee survey found only 14.4 % of organisations have secured full IT and security sign‑off for their entire fleet of AI agents, a figure likely similar for traditional service accounts. While the NIST initiative frames the problem as novel—making it attractive for funding and roadmap inclusion—the underlying drift in permissions and lack of ownership have persisted for a decade. Consequently, adding an agent‑level identity model without first cleaning up the service‑account base merely replicates the same hygiene gaps at a faster, more automated speed.

If enterprises adopt the NIST‑proposed standards without first addressing stale service accounts, they risk amplifying audit blind spots and expanding the attack surface. Unowned credentials can continue to be leveraged by malicious actors, and logs populated by shared secrets will still obscure the true initiator of a transaction. Watch for the forthcoming NIST demonstration project; organisations that have already performed rigorous service‑account reviews will likely reap the most benefit, while those that have not may fall further behind as AI agents proliferate.