--- title: "Who Owns It: Agentic Identity and the Accountable Owner " id: "3814" type: "insight" slug: "agentic-identity-ownership" published_at: "2026-09-18T18:27:45+00:00" modified_at: "2026-09-18T18:27:45+00:00" url: "https://jetstream.security/insights/agentic-identity-ownership/" markdown_url: "https://jetstream.security/insights/agentic-identity-ownership.md" excerpt: "If an action cannot resolve to a name, it is not evidence. How to name the four identities in every agentic workflow and assign one accountable owner." taxonomy_insight_category: - "AI Advisory" taxonomy_insight_type: - "Editorial" taxonomy_insight_tags: - "Agentic AI" - "Agentic Identity" - "AI Kill Switch" - "AI Regulation" - "Non-Human Identity" --- AI Advisory # Who Owns It: Agentic Identity and the Accountable Owner If an action cannot resolve to a name, it is not evidence. How to name the four identities in every agentic workflow and assign one accountable owner. [Agentic AI](https://jetstream.security/insights/insight_tags/agentic-ai/) [Agentic Identity](https://jetstream.security/insights/insight_tags/agentic-identity/) [AI Kill Switch](https://jetstream.security/insights/insight_tags/ai-kill-switch/) [AI Regulation](https://jetstream.security/insights/insight_tags/ai-regulation/) [Non-Human Identity](https://jetstream.security/insights/insight_tags/non-human-identity/) Rusty PerryvCISO & Advisory Board Member September 18, 2026Editorial *This is installment five of seven in [our AI risk management series](https://jetstream.security/insights/audit-the-evidence-ai-policy/) . [Previously: you can prove the running system still matches its design.](https://jetstream.security/insights/runtime-governance-ai-audit-evidence/) This installment: that proof is only defensible if every action ties back to someone.* When an AI system does something it should not have, the first question is never technical. It is “who owned this?” I have watched capable organizations answer that question with a shrug, or worse, with a meeting to figure out whose problem it is. Every control in [this series](https://jetstream.security/insights/audit-the-evidence-ai-policy/) has been building toward the moment an examiner, or a board member, or a plaintiff’s lawyer asks it in five words: who is responsible for this? If your evidence cannot resolve to a name, you do not have evidence. You have an anecdote. ## **You already govern a workforce** Here is the reassuring part (and I mean it): You already know how to do this. You have spent decades governing a workforce. You onboard people, you give them the least access they need, you hold them accountable for what they do with it, and you offboard them when they leave. That discipline is exactly what agentic AI needs. What’s changed? Now your workforce is hybrid. It includes humans, the non-human identities your systems have always had, and a fast-growing population of agents that act on their own initiative. In most shops the non-human identities already outnumber the people, and agents compound the count faster than any hiring plan ever could. Extend the discipline you already have to the new kind of worker and most of this is familiar. Refuse to and you’re running a workforce where a meaningful share of the workers have no manager, no badge, and no record. ## **The identities you must be able to name** Agentic AI breaks a quiet assumption in most identity programs: that an action has one actor. In an agentic workflow, it rarely does. To govern one action, you have to be able to name four things: 1. The human who started it, the invoking user 1. The agent or non-human identity that actually executed it 1. The human product owner who is accountable for that agent, whether or not they were in the room 1. Lastly, the one everybody forgets until it burns them: when agent A hands off to agent B, who authorized B to act, and under whose authority? That last one, the invocation or delegation chain, is where identity programs built for humans quietly fail, because a human does not usually act on behalf of another human three hops down a chain in milliseconds. Agents do it constantly. If you cannot reconstruct that chain, you cannot answer “who is responsible,” because the honest answer is “a sequence of things, and we are not sure which.” Reconstruction is only possible if something threads the chain end-to-end: a trace that follows the task through every handoff, not just the logs that each agent keeps about itself. ## **Governance that travels with the workflow** The instinct from network security is to draw a boundary and watch what crosses it. Agentic systems do not respect the boundary. The workflow is now the perimeter. An agent picks up a task, calls a tool, hands off to another agent, touches a data source, and returns, and the whole path may never cross a network line you are watching. Identity and policy have to travel with the workflow, not sit at a gate it walks around. The authorization that applied when the invoking user kicked things off has to still apply when agent B, two hops later, reaches for a credential. If it does not, you have a workflow that launders authority: it starts with a person who was allowed to do a small thing and ends with an agent doing a large thing that nobody approved. ## **One owner, across the seams** The [anchor article](https://jetstream.security/insights/a-policy-is-not-a-control/) of this series made a point I want to make again. Large enterprises often run multiple governance, risk, and compliance tools, and agentic AI falls into the seams between them. Identity is how you close the seam. Every agent gets one accountable human of record, assigned when the agent is created, not reconstructed later when someone needs a name for the incident report. The org has to decide how to run this, centralized in one governance function or federated to the business lines with a shared standard. There are good arguments for each depending on your size and regulatory surface. What is not optional is the rule underneath both models: nothing runs in production without an owner. The workforce discipline has one more piece that has to come along: offboarding. Agents get retired, superseded, and orphaned by owners who leave, so ownership must transfer the way direct reports do: on the way out the door, not by archaeology after an incident. A stale agent with live credentials is the new stale account, except this one acts on its own initiative. ## **Where the standards put this** This is not a preference. The standards do not use the language of agentic identity, but they point in the same direction: roles, responsibilities, traceability, monitoring, and human oversight. NIST’s Govern function assigns roles and responsibilities, and its Manage function expects you to be able to trace an action and respond to it. ISO/IEC 42001 puts leadership and organizational roles in Clause 5 and carries resource and life-cycle controls through Annex A. The EU AI Act, for high-risk systems, requires record-keeping and traceability over the system’s life (Article 12) and places specific obligations on the deployer who puts the system to use (Article 26). Read together, they describe the same thing an incident does: a chain of actions that must resolve to an accountable identity. Here is what that looks like as an exhibit: the identity and ownership control, the requirement it answers, and the test that produces it. **Exhibit: from identity and ownership to standard.** | Identity and ownership check | NIST AI RMF | ISO/IEC 42001 | EU AI Act | JetStream test | | --- | --- | --- | --- | --- | | A named, accountable owner for every agent | GOVERN 2.1 | A.3.2, Clause 5.3 | Art. 26 (deployer obligations and human oversight) | Every blueprint must have an owner | | Every action traceable to an accountable identity | MANAGE 4.1, MANAGE 4.3 | A.6.2.6, A.6.2.8 | Art. 12 | Every invocation, tool call, and workflow traces to an identity | | Agent and non-human identity (NHI) actions carry provenance | GOVERN 2.1 | A.3.2, A.6.2.8 | Art. 12 (logging and traceability) | Agent and NHI identities get provenance and ownership at creation | | Access is scoped, revocable, and short-lived | GOVERN 1.4, MANAGE 2.4 | Not a direct ISO/IEC 42001 control; inherited from ISMS access-control practices, e.g., ISO/IEC 27001 | Art. 15 | Credentials are scoped, short-lived, and revocable on demand, without anyone touching code | ## **The objection, again, and who it answers** The builder reads “assign an owner to every agent” and hears a manual chore that does not scale, a person clicking through a form for every new agent while the backlog grows. That is the wrong version of this. Ownership and identity assigned by hand do not scale, which is exactly why they have to be a property of the platform: the agent gets its identity, its provenance, and its accountable owner at the moment it is created, and its credentials are scoped, short-lived, and revocable without anyone touching code. Do it that way and the security leader gets the runtime control plane and the kill switch she has been asking for and the builder gets self-service instead of a ticket queue. Privacy can trace any output to an owner and a purpose, and the executive finally has a real answer to “who is responsible” before the board asks. ## **The loop closes** Attribution is the least glamorous capability in a governance program and the first one you will wish you had. Every other control in this series produces evidence. Identity is what makes that evidence mean something, because an action nobody owns is not governed. It is just something that happened. Get this right and the whole loop closes: you can see the system, you approved its design, you proved it ran inside that design, and now you can say, without a meeting, exactly who stands behind every move it made. *Next installment: a well-owned program still has to be affordable, and its cost has to have an owner too. Next, the economics of AI risk.* ## Stay ahead with our newsletter Stay informed on industry trends, expert analysis, and product updates. #### Explore more insights [See all Insights](/insights) [https://jetstream.security/insights/runtime-governance-ai-audit-evidence/](https://jetstream.security/insights/runtime-governance-ai-audit-evidence/) AI Advisory Sep 14, 2026 ###### Proving It Continuously: Evidence, Drift, and Audit-Readiness Attestation is not evidence. The standards ask you to show that a control operated, and runtime is where you either can or cannot. [https://jetstream.security/insights/runtime-governance-ai-audit-evidence/](https://jetstream.security/insights/runtime-governance-ai-audit-evidence/) [https://jetstream.security/insights/ai-agent-security-containment-approvals/](https://jetstream.security/insights/ai-agent-security-containment-approvals/) AI Advisory Sep 3, 2026 ###### Treat Your AI Agent Like an Attacker What fifteen years of chasing lateral movement taught me about AI agents, and the 1990s cockpit research that explains why a human in the loop only helps if the… [https://jetstream.security/insights/ai-agent-security-containment-approvals/](https://jetstream.security/insights/ai-agent-security-containment-approvals/) [https://jetstream.security/insights/ai-security-control-plane-beyond-gateway/](https://jetstream.security/insights/ai-security-control-plane-beyond-gateway/) AI Advisory Aug 27, 2026 ###### An AI Gateway Is Insufficient Security Without a Control Plane Somewhere in your estate, an agent you approved is doing something you did not intend. The question is, what’s the right level of tech to fully gain control of … [https://jetstream.security/insights/ai-security-control-plane-beyond-gateway/](https://jetstream.security/insights/ai-security-control-plane-beyond-gateway/) ## Top Articles 01 Editorial ### [The AI Gateway Isn’t a Cost Play. It’s a Control Plane](https://jetstream.security/insights/ai-gateway-security-control-plane/) July 21, 2026 02 Press Release ### [JetStream Security Achieves FedRAMP Class D (High) Certification Through Second Front](https://jetstream.security/insights/jetstream-security-fedramp-high-certification/) July 22, 2026 03 Press Release ### [JetStream Announces Clearance, a Reasoning Engine That Authorizes Every AI Agent Action](https://jetstream.security/insights/jetstream-clearance-zero-trust-ai-actions/) September 2, 2026 ## Featured Experts [https://jetstream.security/author-bio/patrick-zeller/](https://jetstream.security/author-bio/patrick-zeller/) ### [Patrick E. Zeller](https://jetstream.security/author-bio/patrick-zeller/) General Counsel, Legal and Compliance Patrick has spent over twenty years advising Fortune 100 companies on privacy, cybersecurity, and data protection — including... [https://jetstream.security/author-bio/keith-weisman/](https://jetstream.security/author-bio/keith-weisman/) ### [Keith Weisman](https://jetstream.security/author-bio/keith-weisman/) Head of Forward Deployed Engineering Keith brings thirty years of hands-on cybersecurity and services leadership, beginning with enterprise security consulting at Accenture and... [https://jetstream.security/author-bio/tommy-hui/](https://jetstream.security/author-bio/tommy-hui/) ### [Tommy Hui](https://jetstream.security/author-bio/tommy-hui/) Head of Sales Engineering Tommy Hui has spent more than a decade leading sales engineering at security companies, including six years at...