Agent identity records and runtime controls

For the last year, most agent security conversations have started with vulnerabilities: prompt injection, tool misuse, exposed MCP servers, OAuth blast radius, sandbox escape, workflow automation abuse. Those are real. But the past week exposed a more basic operational gap.

Enterprises are deploying agents faster than they can answer three questions:

1. Which agents are running in our environment right now?
2. What authority does each one have?
3. Can we verify what each agent did after something goes wrong?

An incident responder needs those answers to revoke access and identify affected systems.

The new signal from OWASP and washington

On September 1, 2026, the OWASP GenAI Security Project announced a major expansion of its security resources, including the 2026 Top 10 for LLM Applications and a newly donated Agent Control Standard (ACS). OWASP describes ACS as a way to expose middleware hooks and enforce declarative safety policies across agent frameworks at runtime.

Two days later, Axios reported that Representatives Josh Gottheimer and Mike Lawler were introducing the Stop Rogue AI Act, which would direct NIST to create standards and best practices for secure AI agent deployment. The bill points at controls security teams already know they need: continuously verifying agent actions, evaluating agent security and reliability, generating tamper-proof action logs, and maintaining a continuous machine-readable inventory of AI agents.

Both efforts address agent inventory and evidence of what agents do.

One effort is open standards. The other is policy. Both are converging on the same control layer: agents need passports.

What an agent passport actually contains

An agent identity record associates a task and its permissions with an owner, runtime, and action history.

The point is not paperwork. The point is that every agent action should be attributable to a controlled identity with a known envelope. If an agent sends an email, writes a Jira ticket, runs a deployment, calls a payment API, updates a customer record, or invokes a shell tool, the system should know which passport allowed it.

Without that, your incident response team is left reconstructing a chain of prompts, tool calls, logs, OAuth grants, and human assumptions after the fact.

Why normal asset inventory fails here

Traditional asset inventory answers questions about machines, applications, cloud resources, packages, users, and service accounts. Agents blur all of those categories.

An enterprise agent can be:

• Created by a user in a SaaS workspace.
• Backed by a vendor-hosted runtime.
• Equipped with internal connectors.
• Allowed to call MCP servers.
• Given a service account.
• Modified by prompt, memory, skill file, workflow config, plugin, or API update.
• Delegated work by another agent.

That means the asset is not just "the bot". It is the combination of identity, instructions, tools, data, memory, runtime, and allowed side effects.

This is why "we have SSO logs" is not enough. SSO can tell you a human or service identity authenticated. It cannot always tell you whether an autonomous agent used that identity within its intended purpose, whether the tool call matched the user request, whether a memory item changed the plan, or whether the action crossed a policy boundary.

The OWASP agentic top 10 lens

The OWASP Top 10 for Agentic Applications 2026 is useful here because agent passports cut across several risks rather than sitting inside one box.

The important shift is from static review to runtime evidence. A security review can approve an agent design on Monday. By Friday, the agent may have new memory, new tool paths, changed instructions, different connectors, or delegated tasks it did not have during review.

Agent passports make that drift visible.

The control model security teams should build toward

There are four layers that matter.

The questions cisos should ask this month

If your organization is moving agents into production, ask for answers in evidence, not slideware:

• Show me a live inventory of every agent with tool access, not a list from last quarter.
• Show me which agents can act outside a read-only mode.
• Show me the highest-impact action each agent can take without human approval.
• Show me how we disable one agent without disabling the human user's whole account.
• Show me a full action trace for a real agent task, including policy allow and deny decisions.
• Show me what changes when a tool, plugin, memory store, workflow, or model version changes.
• Show me which actions are irreversible and where rollback is engineered.

Use those traces to verify that the deployed controls match the approved scope.

The next phase of agent security will not be won by debating whether agents are "safe". It will be won by making agent behavior inspectable, attributable, and controllable.

OWASP's Agent Control Standard gives the industry a language for runtime hooks and portable enforcement. The new House bill shows that regulators are converging on inventory, verification, and tamper-resistant logs. The OWASP Agentic Top 10 explains why this cuts across identity abuse, supply chain drift, cascading failures, and rogue agents.

For security leaders, the practical move is clear: before scaling agents, give them passports.

Source: OWASP: September 2026 resources and Agent Control Standard announcement.