Who owns AI agent access? At most companies, nobody knows

Executive summary: A January 2026 Cloud Security Alliance survey of 228 IT and security professionals reports widespread use of AI agents in production systems and fragmented identity and access practices. The findings highlight inconsistent identity representation (shared service accounts, human identities, or workload identities), lack of a single owning team for agent authentication, gaps in credential rotation and access scoping, agents inheriting excessive permissions, and reliance on governance controls rather than technical identity separation. Respondents prioritize real-time visibility, clear separation between agent and human identities, and short-lived per-task access to reduce risk as agentic AI scales.