80% of Enterprises Are Losing Control of Their AI Agents. SailPoint and AWS Just Responded.

This article is based on publicly available announcements from SailPoint, AWS, Gartner, and RSAC 2026. All cited statistics link to original sources.

The Problem: A New Class of Non-Human Identities

Every AI agent deployed inside an enterprise is a non-human identity. It accesses data, makes decisions, and executes transactions - often without the same access controls applied to human employees.

According to SailPoint's March 2026 survey, 80% of enterprises have already experienced AI missteps related to unauthorized or uncontrolled AI tool usage. The proliferation of AI agents is outpacing the governance infrastructure designed to manage them.

Current Identity and Access Management (IAM) frameworks were built for two categories of identity: humans (employees, contractors) and machines (servers, APIs, service accounts). AI agents represent a third category that these frameworks never anticipated - autonomous entities that reason, adapt, and act independently.

SailPoint + AWS: The First Infrastructure-Level Response

On March 16-17, 2026, SailPoint and AWS announced a multi-year strategic collaboration specifically designed to govern AI agent identities inside enterprise environments. This is the first major infrastructure-level response to the non-human identity problem created by AI agents.

The framework unifies three critical functions into a single administrative view:

• Lifecycle Management - creating, modifying, and decommissioning agent identities across their operational lifespan
• Least-Privilege Access - ensuring each agent has only the minimum permissions needed for its specific function
• Policy Enforcement - applying organization-wide security policies consistently across human, machine, and agent identities

SailPoint CEO Mark McClain stated: "The proliferation of AI agents is creating a new class of non-human identities, and each one represents a new attack surface."

Industry Validation: This Is Now Mainstream

Two independent signals confirm that AI agent identity governance has moved from experimental to mainstream:

Gartner has formalized a new category called "Guardian Agents" in its Market Guide, with Orchid Security recognized as a Representative Vendor. When Gartner creates a named category, it signals that enterprise procurement teams are actively seeking solutions.

RSAC 2026 Innovation Sandbox (April, San Francisco) selected Geordie AI - a startup focused entirely on AI agent security governance. The Innovation Sandbox is widely regarded as the most competitive startup showcase in cybersecurity.

The Accountability Question for Regulated Industries

For banks, insurers, and healthcare organizations, the governance gap creates an immediate compliance exposure:

Current regulatory frameworks (HIPAA, SOX, GLBA, PCI DSS) assign liability to individuals and organizations - not to autonomous software agents. The governance layer being built by SailPoint, AWS, and emerging startups will determine how this accountability gap is resolved.

What Organizations Should Do Now

1. Inventory your AI agents. Most enterprises do not have a complete count of AI agents operating inside their networks. Start by cataloging every agent, its access scope, and its decision authority.
2. Classify agent risk levels. An AI agent summarizing meeting notes has a different risk profile than one approving financial transactions. Apply tiered governance accordingly.
3. Extend your IAM framework. Evaluate whether your current identity provider can manage non-human agent identities. If not, assess solutions like SailPoint's new framework.
4. Establish agent audit trails. Every action taken by an AI agent should be logged, attributable, and reviewable - the same standard applied to human employees in regulated roles.
5. Assign human accountability. Until regulatory frameworks catch up, designate a human owner for every deployed AI agent who bears responsibility for its actions.