Most companies have a process for reviewing who has admin rights. Far fewer have one for the AI agents they’ve started deploying. Yet every agent runs under an identity, holds permissions, connects to tools and often touches secrets. If nobody reviews that, an agent can quietly become the easiest route into your most valuable systems.
That’s the question behind AventureCloud agent identity security, a reference build that treats people, workload identities and AI agents as one population on Microsoft’s stack. It reads Entra ID, privileged role assignments, Azure access, Key Vault metadata and Foundry agents (read-only), builds a graph of who can control what, finds routes to “crown jewel” assets, runs 28 rules and proposes fixes that a person must approve.
One important caveat up front: everything runs on a fictional mortgage company with a synthetic tenant. Nothing has been deployed or run against a real organization, and the detection scores are regression checks on data the same author wrote. The value is in the patterns it surfaces, not the exact numbers.
What it set out to test
Three things: whether AI agents deserve their own place in an identity review, how much a structured remediation plan actually reduces exposure, and whether automated fixes can stay safe when an AI is helping explain them.
What was observed
1. The agents were the riskiest group. The overall score on the synthetic tenant was 35.8 out of 100, a grade of F, with 47 findings. The area covering AI agents, workload identities and secrets had 23 of those findings, more than privilege paths (15) and basic identity hygiene (9) combined. Over-privileged agents, agents reading secrets, agents with tools beyond their stated purpose and agents fed by untrusted input all showed up.
2. Too many roads lead to the same place. Each of the four crown jewels, including global admin and the production AI project, could be reached by 22 identities with standing access, 11 of them people. Four paths started from untrusted input that an agent reads, meaning a cleverly worded document could, in principle, steer an agent toward something sensitive.
3. A plan helps a lot, but not all the way. Simulating the full remediation plan raised the score from 35.8 to 90.5 and cut standing paths from people and untrusted input to crown jewels from 48 to 13. Of the plan’s items, 38 applied in simulation and 9 stayed open, because they need a human: a user with only a password registered, and an emergency account with no phishing-resistant sign-in method.
4. The AI explains; it doesn’t decide. Remediation is dry-run only, and the release gate confirms agents cannot approve changes. With the injection guard on, the explainer agent obeyed planted instructions 0 out of 3 times, though that is a small seeded test against a mock model.
Why it matters for a business
If you’re rolling out agents, your identity review is probably missing a third of the picture. Agents accumulate access the same way people do, just faster and with less scrutiny. And automation can close most of the gap, but the final stretch (MFA enrollment, emergency accounts, approvals) still lands on people. Planning for that saves you from a false sense of “done.”
Takeaways
- Put AI agents in the same access review as people and service accounts, each with a named sponsor.
- Map paths to your most valuable assets, not just individual permissions.
- Treat content an agent reads as untrusted input that could carry instructions.
- Let AI explain findings, but keep approval and execution with humans.
- Expect a residue of fixes that only end users or owners can complete, and track them separately.
Reference build
Explore the code, the 28 rules and the honest limitations in AventureCloud agent identity security. It’s a reference build on synthetic data, not client work.
Work with us
Want your team to learn how to secure agent identities, or need trained AI engineers to put this kind of review in place? Write to trainings@aventurecloud.net for trainings or partnerships@aventurecloud.net to talk about a partnership.
Hashtags: #AgenticAI #IdentitySecurity #ZeroTrust
LinkedIn teaser:
In a reference build that scanned people, apps and AI agents together, the agents held 23 of 47 identity findings.
A simulated fix plan lifted the score from 35.8 to 90.5, but some fixes still needed a human. Here’s what that means for your rollout.
No responses yet