Connect
Ask a CIO whether their AI agents are governed under formal identity and access management (IAM) policy, and most say yes. Ask the IT managers on the same team and you get a different answer. In JumpCloud’s Agentic IAM Pulse Report, 68% of CIOs said their agents are fully integrated into formal IAM policies. Only 35% of IT managers and team leads agreed.
Thirty-three points separate those two answers. That’s not a disagreement about facts. It’s a disagreement about whether the existing model covers a new kind of actor.
It doesn’t. And the reason is structural.
What Zero Trust Was Built to Govern
Zero Trust got the core idea right. Identity, not the network perimeter, is where security gets enforced. That insight has held up.
But look at how the model actually makes decisions. NIST SP 800-207 says access is determined by dynamic policy, including the observable state of client identity, the application or service, and the requesting asset.
The operative word is observable.
Human identities are observable in useful ways. A person signs in from a known device. They touch a predictable set of systems. When their behavior shifts, you can challenge them with step-up verification and see how they respond. The policy engine works because the actor behind the identity leaves patterns.
Your policy engine is still doing that job correctly. The question is whether it can see what an AI agent is doing.
Three Ways AI Agents Break the Model
They don’t follow patterns. An agent is a goal-seeking system. It adapts to the inputs it receives. Its access pattern shifts with context and task, so monitoring tuned to human behavior has nothing stable to compare against. The activity looks unusual by human standards but matches no known threat signature. Nothing gets flagged.
They delegate. One agent can spawn sub-agents that inherit its authority. A human makes one authorization decision, and that decision multiplies down a chain nobody approved link by link. An agent with access to HR records can spawn a sub-agent to act on them, which can spawn another to push data to an external system. Zero Trust wasn’t designed for delegation chains that start from a single human yes.
They can be pointed at the wrong target. The Confused Deputy problem (CWE-441) describes an authorized actor manipulated into using its privileges on an attacker’s behalf. At human scale, this is hard to pull off. With agents, a poisoned document or an injected instruction can do it. Authentication passes. Authorization passes. The audit log shows a legitimate access event from a legitimate identity. The manipulation happened at a layer the policy engine was never built to inspect.
Quick check: How well does your current model cover agents?
An AI Agent Is Not a Service Account
The instinct to file agents under service accounts is understandable. Both are non-human identities. Both authenticate programmatically. Both hold credentials and run without a user session.
But a service account is deterministic. The one connecting your CRM to your data warehouse does the same thing on every run. Its access pattern is predictable, so you can scope its permissions to one narrow job and leave it alone. That governance model works because the account never deviates.
An agent has a goal, not a fixed behavior. It decides how to pursue that goal based on what it reads. It can be prompted to do anything inside its permissions. It can spawn sub-agents. It can be influenced by the data it processes. A governance model built for a database connection doesn’t hold for something that reads email, schedules meetings, and queries financial systems. It breaks at the first prompt.
It also explains the 33-point gap. A CIO applying service account governance to agents may be applying it correctly, so the answer they give is a sincere yes. The IT manager looking at the same agents sees a model that doesn’t cover them.
Govern Agents as Identities, Not Features
The fix isn’t a separate tool or a second policy stack. It’s treating every agent as an identity with the same requirements you already apply to people.
That means a formal identity record for each agent, with a named human owner attached. Scoped permissions instead of broad standing credentials. Visibility into what each agent is actually doing, in the same place you watch everything else. And the same lifecycle you run for employees, including the part where access ends.
JumpCloud’s platform governs human, non-human, and agentic identities under one policy engine, so agents don’t sit outside the model you’ve already built.
Your Zero Trust investment was the right call. It just needs to extend to the newest class of identity in your environment.
Want the full breakdown of where the coverage gaps sit? Read The Silent Rollback.
