Frontier AI, rogue agents, and agent escapes have dramatically increased the challenges of protecting and securing AI agents at scale. While the consequences and timeframes have accelerated, just as for any privileged identity, agent actions can be controlled, limited, and tracked by managing the agent's unique identity and associated privilege. Security leaders recognize that they can control agent actions across the enterprise with identity.
To simplify and strengthen agent security, Palo Alto Networks recently took a significant step: Idira’s agentic identity security capabilities are now natively integrated with and generally available with Prisma AIRS, helping enterprises deploy agents with greater confidence. Prisma AIRS Gateway customers can now control, limit, and track agent actions by managing each agent’s unique identity and associated privileges.
Key Takeaways:
- With identity, security teams can control, secure and protect agents across the organization.
- Prisma AIRS customers can now use Idira, the Identity Security Platform from Palo Alto Networks, as the agentic identity provider (IdP) for the Prisma AIRS AI Agent Gateway. This native integration is offered as an option to Prisma AIRS Gateway customers.
- Security teams can gain full visibility of agents’ inventory.
- Unique agent identities help teams limit access and trace actions to agents and, where applicable, the users they act for.
Within the Prisma AIRS AI Gateway and Agent Identity, organizations can manage token usage, select large language models (LLMs), apply identity-based privilege controls to agents, manage MCP tool usage, and gain full attribution and audit capabilities.
This native integration brings together Palo Alto Networks’ market-leading capabilities in machine identity security and the emerging AI application security space.
This native integration brings together Palo Alto Networks’ market-leading capabilities in machine identity security and the emerging AI application security space.
That combination matters as frontier AI expands what agents can do and the consequences of excessive access. Identity gives security leaders a practical way to set and enforce limits on agents across the enterprise.
The solution is designed to address five core risks:
- Untrusted Identities: Unverified agent identities and identities that aren't unique can be impersonated, resulting in untrusted agents that can't be controlled.
- Inherited Human Privileges: Agents, especially AI assistants, frequently inherit human credentials, resulting in over-privileged agents whose actions cannot be differentiated from the human’s actions.
- Ungoverned Shadow Agents: Security teams often don’t have visibility or containment options for unmanaged agents and MCP servers, resulting in uncontrolled and untracked access to corporate resources.
- Attribution Blind Spots: Without unique agent identities, security and incident response teams are unable to track agent actions and distinguish human intent or ownership.
- Exposed Production Credentials: Once an agent gets access to a static credential, such as an application programming interface (API) key or personal access token (PAT), that credential can be shared or stolen, exposing the resources it unlocks.
Putting AI agents to work means giving them authority to act across the business—but only to do their job, and only for the time required. Security teams need to control that authority and set clear limits on what agents can access and do.
That’s what we’re excited about. Agents can do useful work with their own identities and access scoped to their tasks. For CISOs and their teams, that creates a practical path to expanding agent use while keeping agents under control.
The Idira /Prisma AIRS Integration: How it Works
Prisma AIRS customers now have the option to use Idira as the agentic IdP for the Prisma AIRS AI Agent Gateway.
The initial capabilities include identity management, access and authentication, audit and attribution, and credential isolation.
Identities can be managed across the entire agent lifecycle through a centralized repository of agents that includes ownership and available tools. For access and authentication, every registered agent is issued OAuth 2.1 client credentials to generate short-lived, time-bound access tokens, eliminating the need for long-lived shared secrets or human credentials.
Once the agent is authenticated using its unique identity, fine-grained access policies enable security teams to control which resources and tools agents can use. These policies are then enforced at runtime by the AI Gateway.
Once the agent is authenticated using its unique identity, fine-grained access policies enable security teams to control which resources and tools agents can use. These policies are then enforced at runtime by the AI Gateway.
For audit, every agent action is logged with both the agent identity and the associated human identity where applicable, providing end-to-end traceability for investigation and compliance.
Credentials are isolated to prevent the agent from accessing them, helping to eliminate credential sharing and token reuse.
These capabilities integrate with the existing Prisma AIRS user interface, discovery capabilities, and gateway MCP functions, solving the increasingly critical challenges organizations face managing their AI agents. While we've all seen the headlines about rogue agents and agent escapes from frontier models, a nearer threat for enterprise security teams to address is: What can the agents already inside the organization access and do?
It’s a problem security teams can address with identity.
Our Vision for Securing Agent Identities
At Idira, we believe managing identity is the core, critical mechanism required to secure, protect, and control AI agents and their actions. Our goal is to be the most comprehensive identity and access management offering for AI agents, serving as the identity provider of choice for Prisma AIRS customers, for Idira customers, and for third-party AI gateways.
Our vision is focused on four broad areas that center around identity and privilege controls:
- To precisely control access and actions based on the agent's unique cryptographic identity, establishing an inventory of agents and tools.This means supporting all agent types, from assistants to fully autonomous agents, across all environments and deployment mechanisms, with granular access controls (including least privilege, zero standing privileges, or ZSP, and just-in-time access), while automatically downscoping credentials.
- To reduce risk, govern agent identities across their lifecycle, attribute actions back to the agent taking the action and the human sponsor, owner, or initiator, and prevent credentials from being exposed to agents or LLMs via the agent.
- To minimize operational friction while delivering enterprise-grade security, scale, and resilience for agents through automation and simpler processes.
- To take a holistic view of agent identity, leveraging Idira’s expertise to secure all identities across human, machine, and agent workloads.
Our deliberate design choice runs through all of this: Focus on driving security and operational improvements with identity-related controls, recognizing that enterprise environments are complex and evolving, with technologies spanning multiple generations.
None of it works without a foundation. A smooth integration to machine identity security and secrets management is what organizations need to achieve readiness for securing autonomous agents at scale, including Secure Production Identity Framework for Everyone, or SPIFFE, for workloads, agents, and short-lived dynamic secrets.
What’s New in Idira Secure AI Agents
The Prisma AIRS integration is one step, and with this general availability we’re just at the beginning of using identity to help Prisma AIRS better protect and secure agents. Since the initial release of Idira’s capabilities for securing agent identities (Idira Secure Agent Identity) in late 2025, we’ve broadened our capabilities. Here are some of the recent updates.
- Cryptographic Agent Identity. SPIFFE is essential for securing autonomous agents at scale. We're establishing universal cryptographic identities across all agents by provisioning SPIFFE and OAuth 2.1 credentials, including SPIFFE Verifiable Identity Documents (SVIDs). Also coming soon, we're extending cryptographic SPIFFE identities and identity management natively into AWS cloud infrastructure.
- Fine-Grained Access Policies. We now deliver granular access policies for users, MCPs, and autonomous agents, including applying access policies to specific tools available on an MCP. ZSP for databases using the Secure Infrastructure Access MCP server is also available now, with ZSP for cloud providers coming soon.
- Enhanced Audit and Activity Tracking. Risk reduction and audit are where the on-behalf-of problem gets solved. If an agent modifies a production database, logs need to separate human intent from autonomous execution. Most environments can't. Audit granularity tracks that distinction: who ran what tool, on whose behalf, and through which MCP server (available now). An interactive activity map provides visual mapping to trace, analyze, and audit complex agent execution paths across the enterprise. It’s now in early access.
- Developer Credential Protection. For developers using AI coding tools like Cursor or Claude Code, this upcoming capability will shield PATs and API keys from being exposed.
- Identity Governance and Compliance. Unmanaged agent onboarding brings shadow AI agents into central governance using a guided flow (available now), including onboarding and discovering agents that use a cloud provider's origin ID such as an AWS ARN or App ID (available now).
- Automatic OAuth App Registration. MCP servers that support Dynamic Client Registration (DCR) can automatically register the OAuth app and provide audit data for tool interactions (available now).
There’s more detail in the August 2026: What Shipped for Machine and AI Agent Identity blog and the Idira What’s New. Additionally, secrets manager licensing can now be included with Idira Secure Agents licenses, simplifying how Idira Secure AI Agents customers secure secrets for workloads.
Where to Start
Which agent did what, on whose behalf, and with which credential?
If you can’t answer, start there. That's the gap to close first. Assign every agent a unique identity, pull shadow agents into a central registry, and get credentials out of the agent's reach.
If you already run Prisma AIRS, the identity provider integration is available now and is the fastest path to precise agent access controls on the gateway you're already using. To walk through which deployment option fits your environment, reach out to the team.
FAQs
What is AI agent identity security?
AI agent identity security is the discipline of treating all AI agents as distinct, verifiable machine identities rather than anonymous processes. It applies cryptographic authentication, runtime authorization, and continuous auditability to govern what an agent can access and execute.
Why shouldn't AI agents inherit human user credentials?
With 96% of users already having excessive permissions, agents that inherit their credentials also inherit that excess access. Inheriting human credentials gives agents broad standing permissions, masks the difference between human intent and automated execution, and leaves systems vulnerable.