{"id":2479,"date":"2026-09-20T13:53:00","date_gmt":"2026-09-20T11:53:00","guid":{"rendered":"https:\/\/www.kogit.de\/ai-agents-dont-change-everything\/"},"modified":"2026-10-28T14:48:43","modified_gmt":"2026-10-28T13:48:43","slug":"ai-agents-dont-change-everything","status":"publish","type":"post","link":"https:\/\/www.kogit.de\/en\/ai-agents-dont-change-everything\/","title":{"rendered":"AI Agents don\u2019t change everything"},"content":{"rendered":"\n

The technology carousel is spinning faster and faster. New vendors are joining, solutions keep evolving, and no sooner has one approach been understood than the next one is ready. That can certainly make you dizzy.<\/p>\n\n

This makes it all the more important to keep the actual goal in sight. We do not need to have fully mastered every new development in order to ask the right questions. After all, much of what AI agents need has long been part of the tasks of identity management.<\/p>\n\n

What changes \u2013 and what stays the same<\/h2>\n\n

The right identities must receive the appropriate permissions for the right reasons at the right time. When the need no longer exists, these rights must be revoked. At the same time, it must remain traceable which identity received or lost which rights and why.<\/p>\n\n

Looking at usage is also part of this: where does an identity sign in? And where might something be going wrong?<\/p>\n\n

These goals remain. The landscape, however, is becoming more diverse: alongside people and technical users, we increasingly have to manage AI agents. They are meant to act independently, can act quickly and be permanently active. This raises the requirements for their governance.<\/p>\n\n

\"KOGIT_Karussell\"<\/figure>\n\n

Why familiar principles provide orientation<\/h2>\n\n

To put it bluntly: an AI agent is also an identity that we have to manage. That does not automatically make managing it easy. But it does make the task more familiar.<\/p>\n\n

Organisations and identity management teams already bring experience, established processes and expert knowledge. We know the basic rules for identities and permissions. Now we have to apply them consistently to new types of identity.<\/p>\n\n

This includes adapted processes and suitable tools. Which specialised solutions will prevail in the long term is still open. That our toolbox keeps evolving is part of technological development. The familiar principles give us reliable orientation along the way.<\/p>\n\n

Why rules alone are not enough<\/h2>\n\n

One principle remains particularly helpful: we can only manage what we know. That is why technical discovery is becoming more important for AI agents.<\/p>\n\n

We can stipulate organisationally that an agent may only be created after prior approval. However, this does not mean that every agent actually takes this route. After all, a speed limit does not ensure that everyone sticks to it either.<\/p>\n\n

We therefore need technical means of discovering agents that have been created outside regulated procedures as well. They then have to be classified and brought into regulated processes. Established governance rules and technical detection complement each other here.<\/p>\n\n

How we integrate AI agents into existing processes<\/h2>\n\n

Our Identity Security Process provides a basis for this. In the first two stages, we look at the existing landscape and classify the identities. In the Reveal step, discovery helps to make previously unknown AI agents visible.<\/p>\n\n

Once an agent has been detected, we need to clarify what it is used for, who is responsible and which permissions it needs. The further process steps build on this: rights must be granted, reviewed and revoked when the need no longer exists. Their assignment and use must remain traceable.<\/p>\n\n

In doing so, we examine where processes and tools need to be adapted to the characteristics of AI agents. Their speed and their permanent, independent action place additional demands on control. New tasks are assigned to human employees at a manageable pace. With AI agents, this can change within minutes, and they work on their tasks 24\/7. This requires faster<\/em> governance processes and continuous monitoring.<\/p>\n\n

Not every new question can be answered conclusively straight away. Our approach nevertheless remains clear: get to know, classify and apply the familiar principles. This allows us to act and incorporate new insights step by step.<\/p>\n\n

Conclusion<\/h2>\n\n

AI agents create a concrete need for action. At the same time, much of what we have learned about identity management remains valid.<\/p>\n\n

We have the knowledge to tackle this development. Let us use it: with clear processes, suitable tools and confidence in our experience. Even if the carousel is spinning faster, we do not have to reinvent our craft with every turn.<\/p>\n\n

About Martin<\/p>\n\n

Dr. Martin Dehn has been working in Identity & Access Management for more than 25 years. His professional interests combine processes and technology. He is also particularly interested in the interplay between clients, vendors and the various business units that shape identity projects together.<\/p>\n","protected":false},"excerpt":{"rendered":"

The technology carousel is spinning faster and faster. New vendors are joining, solutions keep evolving, and no sooner has one approach been understood than the next one is ready. That can certainly make you dizzy. This makes it all the more important to keep the actual goal in sight. We do not need to have […]<\/p>\n","protected":false},"author":12,"featured_media":1845,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"kogit_anleser":"","kogit_quote":"","kogit_quote_position":"before-3","kogit_article_image":0,"kogit_ai_generated":true,"footnotes":""},"categories":[19],"tags":[],"class_list":["post-2479","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zukunft-identity-security"],"_links":{"self":[{"href":"https:\/\/www.kogit.de\/en\/wp-json\/wp\/v2\/posts\/2479","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kogit.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kogit.de\/en\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kogit.de\/en\/wp-json\/wp\/v2\/comments?post=2479"}],"version-history":[{"count":1,"href":"https:\/\/www.kogit.de\/en\/wp-json\/wp\/v2\/posts\/2479\/revisions"}],"predecessor-version":[{"id":2480,"href":"https:\/\/www.kogit.de\/en\/wp-json\/wp\/v2\/posts\/2479\/revisions\/2480"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kogit.de\/en\/wp-json\/wp\/v2\/media\/1845"}],"wp:attachment":[{"href":"https:\/\/www.kogit.de\/en\/wp-json\/wp\/v2\/media?parent=2479"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kogit.de\/en\/wp-json\/wp\/v2\/categories?post=2479"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kogit.de\/en\/wp-json\/wp\/v2\/tags?post=2479"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}