Agentic AI identity: A 6-stage maturity model for non-human identities

An AI agent with standing access to a production system caused a four-hour outage through a misconfiguration, but no one could identify which human authorized its action because the agent lacked proper identity controls (MFA, scoped access revocation, short-lived credentials). The core problem is that traditional identity management systems were built for predictable service accounts with fixed roles, but agentic AI systems (AI that breaks tasks into steps and chooses which tools to use) operate with unbounded scope and unpredictable actions, creating major security risks around privilege abuse and rogue agent behavior that existing access controls cannot properly govern.