AI Agents Are Exposing the Identity Data Problems Enterprises Never Solved
Takeaways from SailPoint Navigate 2026 from Radiant Logic VP of Product Lisa Grady
The rapid adoption of AI agents is forcing organizations to reconsider how they approach identity security, yet much of the conversation overlooks a fundamental issue: enterprises are trying to govern a new generation of autonomous identities without a complete understanding of the identities already operating in their environments. As AI agents gain the ability to access sensitive information, execute workflows and act on behalf of employees, longstanding challenges with fragmented identity data, inconsistent ownership and poorly understood access relationships are becoming far more consequential.
This was a recurring theme at SailPoint Navigate 2026, where conversations centered on the convergence of human, non-human and agentic identities. SailPoint emphasized discovering, governing and protecting AI agents, reflecting the industry’s shift away from traditional identity governance toward continuous visibility, contextual risk assessment, and real-time enforcement. Yet some of the most revealing observations came from enterprise customers describing problems that had little to do with AI itself. The University of Chicago Medical Center discussed the absence of standardized naming conventions and clear ownership for non-human accounts, while Criteo highlighted the difficulty of determining which agents exist, who owns them and what they can access.
These examples illustrate why the next phase of identity security cannot be addressed by simply extending existing governance processes to another category of accounts. The underlying challenge is establishing a reliable understanding of identity across systems that maintain different records, use inconsistent identifiers and rarely see the relationships between people, machines, applications and access privileges. Radiant Logic refers to this condition as identity sprawl: years of mergers and acquisitions, SaaS adoption and successive IAM and IGA deployments have left most large enterprises with a disconnected collection of identity silos, each with its own version of the truth.
The Problem Isn’t Just Knowing Which Identities Exist
Traditional identity governance was designed around human employees whose access could be provisioned, reviewed and revoked through predictable processes. Non-human identities have complicated that model for years, but AI agents add new uncertainty because they can operate autonomously, interact with multiple systems, and act using credentials or permissions associated with other identities.
Consider an AI agent deployed by an employee to automate a business process. The agent may authenticate through a service account, access several applications and rely on permissions inherited from its human owner. If that employee changes roles or leaves the organization, the agent may continue operating through credentials that remain active, even after the employee’s primary accounts have been deprovisioned. From a traditional governance perspective, the employee’s access may appear to have been appropriately terminated, while the organization remains exposed through an identity relationship it never fully understood. Multiply that scenario across thousands of service accounts, orphaned credentials and identities lacking strong MFA, and the result is an attack surface that few organizations can fully see, let alone govern.
Addressing this requires more than maintaining an inventory of agents or assigning each one a human owner. Organizations need to understand how identities are connected, where permissions originate, which resources can be reached through those relationships and whether the access remains appropriate as circumstances change.
Identity Context Is Only as Reliable as the Data Behind It
Navigate also placed growing emphasis on identity graphs and contextual security, particularly the ability to understand how access propagates through relationships between users, accounts, roles, applications and entitlements. This reflects an important evolution in identity security because risk rarely exists within a single identity record. It often emerges from the connections between identities and the privileges they collectively enable.
However, an identity graph is only as trustworthy as the data used to build it. If employee records, service accounts and application identities cannot be accurately correlated across enterprise systems, organizations may have visibility into individual accounts without understanding their effective access or underlying dependencies. A service account might appear to have limited privileges when examined independently, for example, while its relationships with other identities or applications provide access to far more sensitive resources.
This matters more as organizations move toward real-time authorization and automated remediation. A security platform may be able to evaluate risk and revoke access almost instantly, but only if its identity information is accurate and current. If the underlying data misses an ownership change, an inherited entitlement or a new connection between an agent and an application, even sophisticated enforcement can act on an incomplete picture of the environment.
The convergence of identity governance and security operations makes this challenge more pressing. Security teams need identity context to tell legitimate automation from a potential compromise, while identity teams need security signals to know when access should be restricted. Connecting these functions requires consistent identity data that both disciplines can trust.
Identity Data Never Stands Still
Even organizations that have invested heavily in cleaning up their identity data face a second problem: the sources keep changing.
- An acquisition brings a new Active Directory forest, a separate HR system and thousands of accounts using different naming conventions and attribute schemas.
- A divestiture requires carving out identities, entitlements and service accounts cleanly, without disrupting the business that remains.
- IT modernization projects move workloads to the cloud and decommission legacy directories and databases that dozens of applications still quietly depend on.
Each of these events changes the identity data that governance, security and AI agent oversight rely on. When downstream tools connect directly to individual sources, every change ripples outward as connectors are rebuilt, correlation rules rewritten and applications retested. That cost is a large part of the technical debt that makes identity infrastructure so expensive to maintain and evolve. It also leaves gaps: during a migration or integration, orphaned accounts, duplicate identities and stale entitlements tend to pile up exactly where nobody is looking.
Normalization is what makes this manageable. When identity data from every source is translated into a consistent model, with common identifiers, attributes and relationships, a new source can be onboarded or an old one retired without forcing every consuming system to change with it. The identity graph stays coherent even as the infrastructure underneath it is reshaped.
The Future of Identity Security Starts With the Data
The industry’s move toward unified identity security platforms, continuous authorization and agent governance represents meaningful progress, but adopting these capabilities does not resolve the identity data problems that have accumulated over years. Organizations still run multiple directories, identity providers, cloud services and legacy applications, each describing identities and access in different ways.
At Radiant Logic, we believe this is where organizations must focus their attention. Before enterprises can confidently govern autonomous agents or automate security decisions, they need an identity data foundation that brings together fragmented information, reconciles inconsistent records and lays the groundwork for a coherent understanding of human, non-human and agentic identities across the organization.
The RadiantOne Identity Data Platform is built for exactly this. It abstracts existing identity sources into a unified identity hub, correlating and normalizing identity data from directories, HR systems, identity providers and applications into a common, consistent model, so that human, non-human and agentic identities can be anchored to authoritative context. Because that layer sits between the sources and the systems that consume them, organizations can absorb acquisitions, carve out divested business units and retire legacy directories with far less disruption to their governance and security stack.
With that foundation in place, organizations gain the visibility that identity sprawl has obscured: unmanaged and orphaned accounts, identities not enrolled in strong MFA, and gaps such as service accounts with no clear owner, where those accounts appear in connected sources, all of which are prime targets for attackers.
AI-driven insights and real-time observability then turn that visibility into continuous monitoring and a prioritized path to remediation, feeding the IGA and security tools that act on it and helping teams reduce their attack surface, improve identity hygiene and make better security decisions across the entire ecosystem. This foundation complements, rather than replaces, the agent discovery capabilities showcased at Navigate:
Discovery tools can surface a service account or AI agent, but determining whether its owner is still employed, which business unit it belongs to and what access that person holds across merged directories requires the authoritative context that a normalized identity data layer provides.
AI agents have made this more urgent, but they did not create it. The same gaps that make it difficult to determine who owns an agent or what it can access have long complicated identity governance, security investigations and access management. What has changed is the speed at which those gaps become risk when autonomous systems can act on permissions without a human in the loop.
The next generation of identity security will depend less on discovering more identities or enforcing faster, and more on whether organizations can trust the identity context informing those decisions. Without that foundation, enterprises risk applying increasingly sophisticated controls to an identity environment they still do not fully understand.
