Beyond human identity: Securing AI agents with future-ready SASE
For decades, enterprise security has been built around a relatively stable assumption: people drive business activity.
Employees log in to applications, access data, approve transactions and make decisions. Security architectures evolved accordingly, focusing on protecting interactions between users, devices, networks and applications. Even as organizations embraced cloud computing, hybrid work and digital transformation, the human user remained at the center of security strategy.
That assumption is quickly changing.
The rapid rise of generative AI, autonomous workflows and intelligent agents is reshaping how work gets done. Organizations are increasingly deploying AI-powered systems capable of retrieving information, initiating actions, orchestrating processes and interacting with other systems with limited human involvement. These capabilities offer significant opportunities to improve productivity, accelerate innovation and optimize operations at scale.
Simultaneously, they introduce a new question for security leaders: If AI agents become active participants in business processes, what happens to security models designed primarily for human identities?
As enterprises move toward an emerging operating model often described as the agentic enterprise, cybersecurity leaders must assess whether existing security architectures, including Secure Access Service Edge (SASE), are ready to support a world where access decisions, workflows and business interactions are increasingly initiated by non-human entities.
Understanding the agentic enterprise
The agentic enterprise represents the next stage of digital evolution, where intelligent systems move beyond assisting users to acting on their behalf.
Unlike traditional automation, which follows predefined rules and workflows, AI agents can adapt their actions based on context, objectives and available information. They may retrieve enterprise data, coordinate activities across applications, trigger workflows or make recommendations that influence business decisions.
Consider an AI agent that reviews supplier contracts, evaluates procurement options, accesses financial systems and initiates routine purchasing tasks. Or an autonomous service desk assistant that interacts across multiple business applications to resolve requests without escalating them to human teams. In each case, security teams are no longer managing access solely for employees and contractors. They are governing digital entities capable of making decisions and taking actions independently.
This fundamentally changes the security conversation.
Machines need identities too
Identity has become the foundation of modern cybersecurity.
Zero trust principles, identity-based access controls and SASE architectures all rely on understanding who, or what, is requesting access and under what conditions. However, the identity landscape is evolving rapidly.
Organizations are already managing service accounts, APIs, cloud workloads, containers and machine identities. AI agents add another layer of complexity because they operate across multiple systems and data sources while performing tasks that may previously have required human judgment.
The challenge is no longer limited to verifying identity. Organizations must also understand the scope, intent and impact of autonomous actions.
Security leaders are now asking:
- What resources should an AI agent be allowed to access?
- How much autonomy should it be granted?
- How can permissions adapt dynamically as context and risk change?
- What controls ensure accountability when actions are taken autonomously?
- How can organizations verify that agent behavior aligns with business objectives and governance requirements?
These questions extend beyond traditional access management and point toward a broader challenge: establishing trust in autonomous operations.
Why SASE remains relevant — and must evolve
The rise of autonomous systems does not diminish the value of SASE. In fact, it reinforces many of the architectural principles that underpin it.
Identity-centric access, continuous verification, Zero Trust Network Access (ZTNA), cloud-delivered security controls and context-aware policy enforcement remain highly relevant in distributed digital environments. These capabilities provide a strong foundation for securing both human and non-human interactions. However, the nature of access decisions is changing.
Historically, security controls evaluated users, devices, locations and applications. In an agentic environment, organizations must also consider behavioral context, operational intent, decision-making patterns and business risk.
An AI agent may be authenticated successfully yet still perform actions that create compliance, operational or security concerns.
The future of SASE is therefore not simply about validating identities. It is about continuously validating trust.
As AI agents evolve from assistants to decision-makers, SASE must evolve from validating identity to continuously validating trust.
New risks in an autonomous environment
As organizations embrace AI-driven operations, several security risks require closer attention.
One challenge is the rapid growth of non-human identities. The number of machine identities may increase exponentially as AI capabilities become embedded across business processes. Without effective visibility and governance, organizations risk creating blind spots that attackers can exploit.
A second concern is excessive privilege. AI agents often require access to multiple systems and datasets to deliver value. If permissions are not carefully governed, an agent may gain access far beyond what is necessary, increasing both security and compliance risks.
A third and perhaps less discussed challenge is accountability. Traditional security monitoring focuses on identifying what happened. Autonomous environments require organizations to understand why an action occurred, what information went into arriving at the decision, and whether the outcome aligned with organizational policies. This level of transparency will become increasingly important as regulatory scrutiny and AI governance expectations continue to mature.
An evolving market. A responsive market.
This is not a hypothetical shift. Leading SASE and SSE vendors have already begun building the capabilities the agentic enterprise demands. Several platforms introduced dedicated agent registries and brokering layers in 2026, designed to track which AI agents exist, what permissions they hold, and how their traffic should be inspected and governed alongside human user traffic.
Others have extended their existing CASB and SaaS security posture management capabilities to detect and control unsanctioned AI application usage, while this year's independent analyst coverage of the SASE market has begun explicitly crediting vendors for their ability to secure AI agent-borne traffic and simplify agentic operations.
The direction of travel is clear: agent identity and non-human access governance are moving from research topics to product roadmap in real time.
Evolving SASE for the agentic era
To support autonomous operations securely, organizations must expand how they think about identity, access and governance. Future-ready SASE strategies should be designed around all trusted entities, not just human users. This includes AI agents, machine identities, workloads, APIs and automated services operating across hybrid and multi-cloud environments.
Security leaders should focus on the following 3 steps:
- Extend identity governance.
- Implement adaptive access controls
- Improve visibility across autonomous workflows.
Security and AI governance teams must also work more closely together, ensuring trust, accountability and policy enforcement are embedded into both operational and security architectures. Most importantly, organizations need to shift from a mindset of granting access to one of continuously evaluating trust.
In an environment where intelligent systems can initiate actions independently, trust becomes a dynamic security control rather than a static decision.
The future of enterprise security will not be defined by how effectively we manage human access, but by how confidently we establish trust in autonomous systems.
How SASE is molding the agentic enterprise
The agentic enterprise is no longer a future concept. It is already taking shape as organizations embed AI assistants, autonomous workflows and intelligent agents into daily operations. SASE remains a strong foundation for securing this transformation, but its next evolution must address a reality that security architectures have not encountered at scale before: a world where machines increasingly act as participants rather than tools.
Success does not only depend on how quickly organizations deploy AI, but on how effectively they establish trust around it. Security leaders must extend governance beyond human users, continuously validate trust and ensure autonomous actions remain transparent, accountable and aligned with business objectives.
As the boundaries between human and machine activity continue to blur, the future of SASE may ultimately be defined not by secure access alone, but by trusted autonomy.
Marcin Lewandowski
Product Director - GDC CYS MS Hybrid Cloud & Plat. Security
View detailsof Marcin Lewandowski >
