A Note from the Managing Director
The Identity Underground started because we believed the most honest conversations in identity security weren't happening in public — they were happening in hallways, in side chats, and in the kind of candid exchanges that only happen when the cameras are off.
Every quarter, we bring identity security executives and practitioners together under Chatham House rules to do exactly that: speak freely, challenge assumptions, and share what's actually working.
This Executive Summary of the Q2 2026 Wisdom Report is our way of giving the public a glimpse into the Underground — the real conversations shaping how our industry is responding to one of its most urgent inflection points.
Q2 raised a sharp question. Not what an agent is, but whether anyone can see what it has become.
This is what our community is saying.
— Jessica Stone
Managing Director, The Identity Underground
One sentence from this quarter's sessions has stayed with me. The agent you authorized last quarter is not the agent running today. The credential didn't change. The policy your security team approved is still sitting in the system exactly as it was. But the thing operating in your environment, reasoning and calling tools and chaining decisions, has quietly become something else.
That idea ran through all four sessions, and it reframed a debate our community has circled for a year. We spent that year arguing about what an agent is: human, non-human, or something new. This quarter a sharper question surfaced. Not what an agent is, but whether anyone can see what it has become.
“Once something can take an action, it immediately becomes an identity control problem.”
Authorization was never the whole story
Identity systems answer what an agent may do. They have nothing to say about what it will do. Potential authority is what the access grant contains, the permissions and the scope. Exercised authority is what the agent does with that grant in the moment. For human users and traditional service accounts, the gap between the two stayed small and predictable. For a reasoning agent, it's neither.
“IAM defines what an agent is allowed to do. But it doesn't define how the agent decides how to use what it's allowed to do.”
So where does exercised authority live? We consider it in two places no access system controls. The instruction layer, meaning the persistent files that load into an agent's context on every run, version-controlled and editable and invisible to identity teams. And the tool layer, the set of capabilities an agent can call, each one bundling access and logic together. Two agents with identical permissions but different tools are not the same agent.
A badge gets you through the door, but it doesn't tell anyone what you do once you're inside the building.
Another example was shared: A developer wanted to connect an AI coding agent to the company's HR system, and the connection was blocked. The agent knew the company ran another internal tool, and it found a path around the block just to finish the task. Access that looked scoped, behavior that acted wider.
Retrofitting for this is harder than it sounds, because changing an access policy is clean and reversible and auditable, while changing an instruction file produces different outcomes depending on context and prompt. Identity systems reason about permissions, read this and write that. Tools reason about tasks. A narrow-looking task can sit on top of a very broad permission, and nobody has the question on a checklist yet: has this agent's exercised authority changed since we approved it?
An agent is a third kind of identity, and it must be hired, watched, and fired like one
Identity moved through workforce, then consumer, then non-human. Agentic AI is a distinct category that behaves like none of them.
“We cannot simply treat them as automation tools anymore. These are behaving as privileged organizational identities, with decision-making capabilities and critical system access.”
The model in discussion was autonomy in levels, from systems that recommend while a human approves, through systems that execute under supervision, to systems that plan and decide and act alone. As autonomy rises, answering who approved an action gets harder. So agents need the lifecycle we already give people: discovery, registration with a named owner, scoped provisioning, credential management, monitoring, and a safe way to suspend and decommission.
The language everyone reached for was employment, and it fit better than anyone wanted it to. An agent must be hired, paused, and fired, except there may soon be a hundred of them per person.
One concrete proposal became the quarter's most contested argument. If attacks arrive in milliseconds, human-speed detection can't answer them, so we discussed an automated kill switch that detects an agent drifting from its baseline and shuts it down on its own.
“Something needs to happen in milliseconds to immediately stop the agent from doing more damage. The moment it checks, it has been compromised.”
It was accepted immediately - because a switch fast enough to stop an attack is also fast enough to halt a business.
“A kill switch can create more damage. It can kill the patient. Rather than provide medicine, it can kill the patient altogether.”
Then the harder question, which nobody resolved. Who answers for pulling it? The session's moderator named the discomfort directly: he wouldn't want to be the owner deciding, in real time, whether to shut down a business-critical agent. Everyone agreed that the threshold is hard to set and that some business functions would refuse it outright.
Hiring an agent is the easy part. Deciding who fires it, in the second that counts, is the job nobody volunteered for.
Maybe none of this is new, and that's exactly what makes it dangerous
Underneath every theme ran one disagreement that never fully settled. One camp held that this moment is genuinely new. The other, held that it's the same authorization problem we've wrestled with for decades, only moving faster than our controls were built to match.
“I'm not sure we have a different problem. We've got the same problems we've had for the last twenty years. It's just the speed at which we can execute and take advantage of those problems that's now scaled.”
The same executive drew the consequence: give an attacker millions of agents running the old playbook, and an environment becomes Swiss cheese faster than anyone can see the holes open.
The executives kept landing in the same place. Directories, authentication, privileged access, lifecycle management, none of that moved. What moved is that a little bit of each is no longer enough. Our moderator turned it into the quarter's clearest instruction: we can't do a little bit of MFA, we can't do a little bit of any of it.
A quieter thread ran inside this one, about who owns an agent at all. Several executives held that every agent needs a responsible human at the top and a single source of truth, an HR system for agents. Others argued that a human signing off on machine-speed decisions is a bottleneck rather than a control, and that agents will need supervising agents of their own. A director of IAM engineering offered the note that cuts across both. Whatever the model, policy can't become friction, or people route around it.
The to-do list is old. The deadline is new.
The tools we manage identity with were never built to run at runtime
The practitioners took those concepts and pressed them against production. Their most pointed claim was that the tooling we manage identity with today won't survive the shift.
“I do not believe traditional IGA platforms can scale to handle this at runtime. I just don't see it.”
The prescription was architectural. Couple the control plane and the data plane tightly enough to push changes in real time, because syncing on a schedule can't keep pace with agents that appear and act between sync windows.
“Your data plane and control plane need to be so tightly coupled, at the speed this is going, that you can't sync data anymore. It has to be pushed, real-time.”
From there we reach for graphs, to model permissions and detect drift across chained and delegating agents, and for an agent registry capturing each agent's context and purpose. He held no illusion the industry will converge on one registry, calling the likely outcome a familiar mess by a new name. SCIM for machines, all over again.
What was described wasn't a tool but a runtime fabric that can answer questions about agents as fast as agents act. Sync was built for human time, and agents don't keep it.
The plumbing we built for humans is cracking under agents
The second practitioner thread went under the floorboards, to authentication itself. Protocols built for human sessions can't describe what an agent needs, which is a permission that lives only as long as the task in front of it. A practitioner active in identity standards groups was blunt about the timeline.
“OAuth can’t solve this problem. It can’t survive for more than a year, the way MCP and other things are coming. There must be a new protocol.”
A deeper blocker ahead of the protocol question, though. Language. The field doesn't agree yet on what these things are.
“The taxonomy is the biggest problem I'm seeing in the industry.”
That naming gap isn't academic. You can't register, govern, or revoke a category you can't define. And underneath it sat an older admission, from a practitioner leading identity at a major automaker: the industry never really finished non-human identity, and agents are landing on top of the unfinished work.
Agentic AI multiplies every gap you haven't closed
The last practitioner theme was operational, and it reframes the threat in a way leaders can act on this quarter. Agentic AI mostly doesn't create new categories of risk. It multiplies the ones already sitting in the environment.
“It pops holes in your boat when you already have them around your identity security process.”
The same dynamic shows up in how teams absorb AI-assisted development. A practitioner described code volume rising roughly tenfold once developers had those tools, pushing toward an uncomfortable destination: trusting AI to review the code that AI generated.
A debate played out live between handing out coding licenses to find out who's building and locking down first. The room landed on discovery before distribution, with hard cost ceilings at the cloud provider, because runaway spend is a when rather than an if.
Here's what connects all of it
Authorization was never the whole story. A grant describes what's allowed, instructions and tools decide what happens, and an agent's exercised authority can drift a long way from what anyone approved with the credential untouched.
Ownership outranks tooling. Every workable model this quarter started with a sentence about accountability, someone owns this agent, before it reached a sentence about permissions.
Visibility comes before control, without exception. Discovery before licenses, baselines before kill switches, an inventory before a lifecycle. Every practitioner who tried it the other way round reported a failure.
And the fundamentals didn't change, only the timeline did. Unsolved non-human identity, partial MFA, the directory nobody consolidated. Agentic AI didn't add those items to the list. It removed the option of deferring them.
If you're still approving agents on the strength of what their permissions say, you're governing a fraction of the agent. The rest of it is already running.