My AI Agents Are Non-Human Identities. I Manage Them Like Insiders.

Thomas Prommer Technology Executive & CTO Connect on LinkedIn

Published: October 21, 2026

Updated: October 21, 2026

I run a fleet of nine agentic coding hosts. They do routine engineering work across my portfolio of sites. They write the change, commit it and ship it, often without me reading the diff first. That's the point of them. It also means that on a typical day, a large share of the commits to my sites come from identities that aren't people.

On October 19, 2026, Microsoft's security business chief, Hayete Gallot, wrote that "frontier models, regardless of their origin, cannot be trusted." Her point wasn't that they're malicious. It's that they're unpredictable. I agree, and I think it's the right way to think about an agent fleet: not as a tool you configure once, but as a set of insiders whose authority you manage.

Why is everyone suddenly talking about agent identity?

Because the money arrived. In the four weeks to October 20, Nvidia launched an agent safety platform that monitors agents from hardware outside their host, Proofpoint agreed to buy Varonis for $6.3 billion citing AI agents, and Reco, Pluto Security and Opsin all raised rounds to find and govern agents inside companies. Opsin's own analysis found that 93% of misaligned tools connected to agents had full, unrestricted access to the systems they used, and only one in 200 needed human approval before acting. The vendor-by-vendor view is in the AI agent security vendors roundup on wetheflywheel.com.

The underlying shift is simple. A service account runs a fixed script. An agent decides what to do next. Once software chooses its own actions with real credentials, the questions you used to ask about an employee apply to it too.

What are the four questions I ask about each agent?

I use the same questions I'd ask about a new contractor on an engineering team. They're simple, and that's why they work.

1. Who is it? Every agent should act under its own identity, not a human's account or a shared key. If something goes wrong, the first thing you need is to know which agent did it.
2. What can it touch? The scope should match the job: these repositories, this environment, nothing else. Access that's broader than the task is the 93% problem from Opsin's data.
3. What did it do? All my agents' model calls go through one gateway, which applies the same logging and limits to every caller, and every code change lands in git. Between those two records I can reconstruct what an agent asked for and what it changed.
4. How fast can I stop it? Revoking one agent's credentials should take minutes and shouldn't affect the others. If stopping one agent means stopping all of them, the identities aren't really separate.

Where should a human stay in the loop?

Not on every change. That would defeat the purpose of a fleet. The way I think about it comes from coaching. A good coach doesn't watch every training session. They set the plan, look at the numbers, and step in at the sessions where a mistake costs the season. For agents, those are actions that are hard to undo: anything touching money, credentials, people's data, or messages that leave the system. Routine code changes that can be reverted from git are the sessions you let the athlete run alone.

This is also where I'd disagree a little with how the big platforms frame it. Microsoft and Nvidia both want agent security to be a feature of their platform. If you live entirely inside one cloud, that's fine. My agents call models from more than one provider through a gateway I control, so the identity and the audit trail have to sit on my side of that line, not inside any single vendor's product.

Does a small operator need an agent security product?

Not yet, in my view. Most of the products funded this month solve discovery: finding agents that employees created without telling anyone. Pluto found that about 60% of the risks it detects are in tools built by non-developers, and finance teams were the biggest source. If you're a company of thousands, that's your problem and those tools are worth paying for. If you're running your own fleet, you already know what exists. Your job is to keep identities separate, scopes narrow and records complete, and to check now and then that they still are.

The cost question is the same one I asked in AI bubble or buildout: what's left standing if things go wrong. For an agent fleet, the answer should be a clear log of every action and a working revert.

Sources

• TechCrunch, Microsoft says AI agents are like insider threats as frontier models can't be trusted (Oct 19, 2026).
• TechCrunch, Pluto Security raises $42M (Oct 13, 2026).
• Pulse 2.0, Opsin raises $21 million for AI agent security (Oct 15, 2026).
• SC Media, Nvidia launches Open Agent Safety Platform (Sep 2026).
• TechCrunch, Cyera agrees to acquire Oasis Security for $1B (Jul 2026).