Enterprise Agent Identity Governance Framework (EAIGF): A Policy-Mediated Identity and Access Governance Model for Autonomous Digital Workforce Systems
Abstract
Agentic Artificial Intelligence (AI) systems are evolving from passive decision-support tools into autonomous digital workers capable of planning, reasoning, invoking tools, accessing enterprise resources, and executing business actions with varying degrees of autonomy. While enterprises maintain mature governance models for human identities, service accounts, and application identities, existing Identity and Access Management (IAM) frameworks do not adequately address the governance challenges introduced by autonomous agents. Unlike conventional applications, agents dynamically determine execution paths, invoke reusable skills, delegate tasks to peer agents, and perform privileged actions across enterprise systems. These characteristics define a new class of enterprise identity that requires dedicated governance, authorization, and accountability controls. This paper proposes the Enterprise Agent Identity Governance Framework (EAIGF), which treats autonomous agents as first-class enterprise identities subject to lifecycle management, quantitative trust classification, privileged access governance, and end-to-end accountability. The framework's principal constructs form an identity layer comprising the Agent Identity Registry (AIR), the Agent Provisioning Certificate, Agent Trust Tiering driven by an explicit Agent Identity Risk Score (AIRS) formula, Agent Privileged Access Management (Agent-PAM), and a Delegated Trust Chain with Agent Identity Lineage for multi-agent accountability. These constructs are enforced through a policy-mediated runtime boundary that performs capability projection and risk-adaptive authorization. A reference implementation realizing the registry, the AIRS formula, capability projection, and risk-adaptive authorization correctly enforced all ten governance scenarios in the evaluation with zero false-permits on disallowed capabilities and a mean authorization overhead of approximately 0.015 ms per request. A larger randomized evaluation over 600 authorization requests across 80 agents and 25 reusable skills reproduced this result and, against a naive whole-skill authorization baseline, reduced the exposed capability surface by 66.7 percent while blocking every attempted privilege escalation through delegation. A synthetic financial-services walkthrough demonstrates how Identity Governance and Administration (IGA), Privileged Access Management (PAM), and Zero Trust principles extend to agentic environments. EAIGF provides a practical blueprint for governing autonomous agents at scale while preserving least privilege, accountability, and operational resilience.
Keywords
References
Most read articles by the same author(s)
- Dr. Wei-Lin Cheng, COLLATERAL EFFECTS AND UNINTENDED REPERCUSSIONS IN OFFENSIVE CYBER OPERATIONS: A SYSTEMATIC LITERATURE REVIEW , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 03 (2025): Volume 02 Issue 03
- Dr. Elena Marovic, Dr. Sofia Markovic, Cybersecurity Governance and Resilience in Small and Medium-Sized Enterprises: A Socio-Technical, Resource-Based, and Regulatory Framework for Sustainable Digital Competitiveness , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 04 (2026): Volume 03 Issue 04
- Dr. Jakob R. Neumann, Prof. Leila F. Mahmoud, Securing the Virtual Meeting Space: An Analysis of Cybersecurity Risks and Mitigation Strategies for Video Conferencing Platforms , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 09 (2025): Volume 02 Issue 09
- Dr. Julian R. Cortez, A Comparative Analysis of Image Encryption Techniques Based on Linear Feedback Shift Registers and Chaotic Systems , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 05 (2026): Volume 03 Issue 05
- Dr. Alistair Finch, Navigating the Digital Battlefield: A Systematic Review of Collateral Effects in Offensive Cyber Operations , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 08 (2025): Volume 02 Issue 08
- Aghasi Gevorgyan, Automation of Compliance Control Processes According to PCI DSS Standards in Hybrid Cloud Environments , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 04 (2026): Volume 03 Issue 04
- Dr. Samuel O. Adebayo, A Socio-Technical Approach to Mitigating Cybersecurity Risks in Industrial Control Systems: The Vulnerability Analysis Critical Impact Point (VACIP) Methodology , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 06 (2026): Volume 03 Issue 06
- Dr. Ahmed N. El-Tayeb, Miguel Ángel Ortega, INTEGRATING CYBER THREAT INTELLIGENCE WITHIN COMMERCIAL ENTERPRISES: A STRATEGIC FRAMEWORK FOR ENHANCED SECURITY POSTURE , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 1 No. 01 (2024): Volume 01 Issue 01
- Dr. Chinedu Okafor, Dr. Aisha Bello, An Intelligent Risk-Aware Security Framework for Detection and Prevention of Cyber Attacks on Critical Power Grid Infrastructure in Nigeria’s Electricity Sector , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 08 (2026): Volume 03 Issue 08
- Dr. Ahmed Saeed Al-Mansoori, Detection of Malicious Query Attack Weaknesses within Online Software Systems Using Byte-Level Pattern Matching , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 04 (2026): Volume 03 Issue 04
Similar Articles
- Lukas Schneider, Anna Müller, A STRIDE-Based Cybersecurity Framework for Threat Detection in Federated Identity and Access Management Systems , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 09 (2026): Volume 03 Issue 09
- Parijat Sharma, Non-Human Identity as the Primary Attack Surface: A Governance Architecture for AI Agent Credentials in Regulated Multi-Cloud Enterprises , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 10 (2026): Volume 03 Issue 10
- Ashutosh Palia, CMDB Data Governance and Business Continuity: Identifying Research Gaps in AI-Driven IT Operations , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 09 (2026): Volume 03 Issue 09
- Aghasi Gevorgyan, Automation of Compliance Control Processes According to PCI DSS Standards in Hybrid Cloud Environments , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 04 (2026): Volume 03 Issue 04
- Haruto Nakamura, Yui Takahashi, Adaptive Authentication Framework for Agentic AI Ecosystems: Protocol Design, Trust Evaluation, and Security Analysis , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 09 (2026): Volume 03 Issue 09
- Muhammad Hamza Khan, Ayesha Noor Malik, AI Governance and Cybersecurity Policy in the Public Sector: Balancing National Security, Data Privacy, and Ethical Risk , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 08 (2026): Volume 03 Issue 08
- Dr. Elena Marovic, Dr. Sofia Markovic, Cybersecurity Governance and Resilience in Small and Medium-Sized Enterprises: A Socio-Technical, Resource-Based, and Regulatory Framework for Sustainable Digital Competitiveness , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 04 (2026): Volume 03 Issue 04
- Nguyen Minh Khoa, Tran Thi Lan Anh, Strategic Business Transformation through Data Analytics, Sustainable Practices, and Innovation Management , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 09 (2026): Volume 03 Issue 09
- Hiroshi Tanaka, Yuki Nakamura, Improving JWT Security Through Dynamic Token Binding and Behavioral Context Analysis , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 3 No. 09 (2026): Volume 03 Issue 09
- Dr. Jakob R. Neumann, Prof. Leila F. Mahmoud, Securing the Virtual Meeting Space: An Analysis of Cybersecurity Risks and Mitigation Strategies for Video Conferencing Platforms , International Journal of Cyber Threat Intelligence and Secure Networking: Vol. 2 No. 09 (2025): Volume 02 Issue 09
You may also start an advanced similarity search for this article.