AI agents need identities before companies can control them

A company cannot authorise an AI agent it cannot identify. Fotis Chantzis, Agent Security Lead at OpenAI, argued this on a Black Hat USA 2026 panel on AI and the future of cyber defense. He put agent identity first, and later told firms to inventory their agents and keep audit trails.

What was said

The host described an agent as a model with credentials, tools and memory. Chantzis called agent identity "probably the most important thing right now." His reasoning: "You can't really authorize what you can't identify, and that includes agents."

He said a company must see what an agent does down to the single action, which tools it uses and which connectors it reaches. That applies to a personal assistant on a laptop. It also applies to a coworker-style agent set up in company infrastructure and shared among colleagues.

Access should follow the task, he said. As the agent's job changes, its credentials should widen or narrow to match. He said that needs AI in the loop, so firms should adopt AI more, not less.

He put an audit trail of the agent's whole trajectory next, with monitoring second. He described a supervising agent, called auto review, deployed on Codex. It watches actions that need more privilege to cross the sandbox boundary, judges how risky the path looks, and decides whether to allow it. The aim is to spare humans from approving every step, which he said causes decision fatigue.

Morgan Adamski of PwC said that for firms with the basics in place, identity is among the first subjects she raises. She said agents should get only the access they need, and firms should be able to shut them down or fence them in. She added that agents have been seen breaking out of their sandboxes.

Why it matters

Our reading: a shared agent does many jobs for many colleagues, so one fixed credential would have to cover its widest job. Task-based access avoids that, but only if the system knows which agent is asking.

The same holds for the rest. An audit trail, a supervising reviewer and an off switch each need something to attach to. Identity is that thing. Managers can start with plain questions. Which agents run here? Who owns each? What can each reach? Can we stop it?

The other side

Knowing your assets is hard, but the panel did not measure it for agents. Sergey Konovalov of Anthropic said the industry average is about two out of ten operators with a firm grasp of their assets. He said this while answering a question about water-facility intrusions and small operator IT teams. It was about asset knowledge, not agents, so at most it is an analogy.

The tooling is also young. Chantzis said his team is working with the IETF, an internet standards body, and others to push standards. Auto review uses AI to watch AI, and the panel did not test how well that works. Adamski said a firm with no security investment should first map its footprint and attack surface. Identity does not prove an agent is safe. It only makes control possible.