AI Agent Identity: Service Account Hygiene Risks Exposed

AI agent identity is facing a new governance problem, but many companies still have unresolved issues with service account hygiene. What's happening is that problems often surface during migrations. Something stops working, and the issue traces back to a service account nobody knew existed. For example, a Windows scheduled task might be running as a domain administrator without a clear owner for years. This pattern keeps appearing because migrations are often the only time companies are forced to figure out what an application truly depends on. These dependencies often include credentials with more access than anyone remembers granting. Scoping these accounts to only the necessary permissions takes time, but it allows for justified and revocable access. This hidden dependency problem isn't new. It’s similar to other migration risks where small, relied-upon workflows are overlooked. The old service account problem remains largely hidden until a migration forces its discovery. NIST recently addressed this. They published a draft concept paper in February 2026 on identity and authorization for software and AI agents. The public comment window closed on April 2, 2026. This paper proposes applying identity standards like OAuth 2.0 to AI agents. It focuses on identifying agents distinct from human users.