2026 State of Passwordless Identity Assurance Report | 
Your Own AI is Now The Insider Threat.
Retake control.
Autonomous work is a board-level priority. Every enterprise wants autonomous AI at scale. Almost none of them have the controls to do it safely.
The journey
The trek of workforce agentic adoption
The mountain-range metaphor is apt for enterprise AI adoption. Each milestone feels like the goal — until you reach it and see the next ridge rising ahead. Security and IT teams are discovering this the hard way.
01 · Observability
Understand what exists
Organizations begin by trying to understand what agents exist. Endpoint detection, network monitoring, and API traffic logging give security teams their first real inventory of AI tool usage.
The next ridge: reveals how little you can actually control it.
02 · Restriction
Block what's unsanctioned
With a map in hand, the instinct is to block. Unsanctioned APIs get cut off. Traffic gets routed through corporate gateways. Shadow AI gets addressed — officially.
The next ridge: reveals how easily users route around it.
03 · Governance
Apply the policy
Policy frameworks come next. Central controls get applied to defined use cases. Session-level enforcement gives security teams a lever. Audits become possible.
The next ridge: reveals how hard it is to enforce on a non-human actor.
04 · Assurance
Reach the supervision peak
The complete picture: agents with verifiable identity, policy enforced inline, human supervisors in the loop for high-risk actions, and the ability to revoke, constrain, or shut down any agent instantly.
The supervision peak: known, governed, and accountable.
The framework
Three capabilities.
Reaching the assurance peak requires a fundamentally different approach than IAM and security teams are used to. Agents need their own identity model, their own scope of authority, and their own accountability chain.
Identity
No identity, no policy. No policy, no accountability.
Every agent needs a verifiable identity bound to a human owner, a defined scope of authority, and a time-bounded delegation model. A named agent, with a verified scope, acting on behalf of a named human, within a defined window — that's enforceable.
“Allow agents to access CRM data” is not a policy. It's a hope.
Enforcement
Stop it at the source, not after the fact.
Control has to start at the endpoint — where the agent process runs. Traffic-level controls are necessary but insufficient. An agent that can route around the gateway by going direct to an inference provider has already escaped governance. The only reliable control point is the endpoint itself.
Seeing it happen and stopping it are not the same thing.
Accountability
Autonomy scales when humans stay in the loop.
Autonomy and accountability are not opposites — but they require deliberate design. High-risk actions need a human checkpoint: low-friction enough that it doesn't become a bottleneck, high-integrity enough that approvals are cryptographically meaningful. A supervisor who can approve, deny, constrain, or terminate an agent in real time is what makes scale safe.
Approve, deny, constrain, or terminate — in real time.
Agent control model
Two levels of control to optimize agentic scale.
Effective agent governance operates at two distinct levels — organizational controls set by administrators, and operational controls managed by the people deploying agents day to day.
Organization-Wide Policies for Total Agent Control
Out-of-the-box, compliance-driven policies for all enterprise agents.
Control has to start at the endpoint — where the agent process runs. Organizations must have the ability to govern and control agent actions through delegated approval flows, time-bound agent sessions, etc.
Dynamic Agent Supervision for Agent Owners
One place to monitor all active agents.
Every agent needs a verifiable identity bound to a human owner, a defined scope of authority, and a time-bounded delegation model. Agent owners should have one place where they can supervise and manage all active agents with control over additional policies and oversight they would like to impose.
Create Trust in Every AI Agent
Enable scale of autonomous work with agents with verifiable identity, policy enforced inline, human supervisors in the loop for high-risk actions, and the ability to revoke, constrain, or shut down any agent instantly.
AgentPass Design Partnership Overview
This is a fast-paced, high-fidelity co-development initiative.
The rigorous 3-month window is focused on real-world business problems, deep integration, and verifiable security values for the enterprise.