When Agents Became Users: Rearchitecting Identity and Permissions for AI at Scale

Most platforms add AI agents as apps: the agent runs with the permissions of whoever invokes it. Simplest thing to ship. Across hundreds of thousands of teams, serving enterprises that audit every access, that model fell apart. This is how we rebuilt agents as first-class users, with their own identity, permissions, and audit trail. The first architecture was the obvious one: an agent could do only what both it and the invoking user were allowed to do. Simple to build, it broke at scale. The agent’s access changed with every invoker, so no one could say what it could actually reach. Actions were attributed to the human, leaving no per-agent audit. And a shared agent became a leak risk, exposing its invoker’s data to everyone allowed to run it. Fixing this meant making a non-human a first-class user inside a system built for humans: its own identity, scoped least-privilege permissions, admin-managed provisioning, and a place in the workspace where it can be assigned work and audited. The payoff was counterintuitive. Once an agent is a user, 20 years of enterprise identity infrastructure (SSO, RBAC, provisioning, audit logs) works for it for free, instead of a separate control plane for AI. One enterprise built 25 agents, each needing different access. Before, any agent could read what its invoker could read and pass it to the whole team. Now each is shared across the team and never touches data it was not explicitly granted. The permission models, the tradeoffs we got wrong first, and what it takes at scale. From the applied AI perspective, why agent identity is the central design problem for AI at work. Expect real systems and real failure modes.