Every Agent
Answers
to a Human.

AI agents get hired by the thousand and never show up in your HR system. AgentID will wire every agent identity, and every sub-agent the providers record, to a named human owner drawn from the identity provider you already run. When that human leaves or is compromised, the company will hold real options instead of none.

A note on what ships today: AgentID can issue each registered agent its own expiring ID today (you set the lifetime, from one transaction to 12 months) and checks the calls it sends through the AI Gateway. Linking each agent to a named owner in your identity provider is planned and not available yet.

The most dangerous question in enterprise AI right now is also the simplest one: who owns this agent? Most organizations can name the model, the vendor, and the cloud bill behind an agent. Ask which human being is accountable for its identity, who vouched for it, who renews it, who is answerable when it acts, and the room goes quiet. That silence is the gap this field note is about.

Your People Are Governed. Your Agents Are Not.

Enterprises spent two decades building serious identity systems for people. Okta, Microsoft Entra ID, Ping: directories that know who joined, who moved, who left, and what each person may touch. That machinery works, and Arkion does not ask you to replace an inch of it. AgentID will connect to Okta or Microsoft Entra ID and treat your directory as what it already is: the single source of truth for human beings.

AgentID will anchor every agent identity it issues to an owner, and that owner will not be a text field or a spreadsheet column. It will be a live binding to a human identity in the directory you already operate, so the agent will act under an identity tied to a specific, named human. Accountability will be on record before an incident, not reconstructed after one.

Agents That Spawn Agents

Here is where most identity thinking breaks down. Modern agent architectures are not one model with one credential. An orchestrator plans, then fans the work out to sub-agents, which may spawn workers of their own, at whatever depth the task demands. In most stacks today, those children either borrow the parent’s credentials or mint anonymous ones, and the chain of accountability snaps at the first fork.

With AgentID, a sub-agent the providers record can be registered and issued an identity of its own, separate from its parent’s, and AgentID maps which agent it works for from the provider’s own records. Owner binding will add the last link: this parent agent is owned by this human. Pick any sub-agent AgentID has found, and you will be able to walk it back through every parent the providers record to a named person.

The plainest way to picture the goal: an org chart that machines cannot opt out of. Every agent should report to something, and every chain of reports should end at a human being. Spawning should not dilute ownership. It should extend it.

The Day the Owner Leaves

The most reliable identity event in any enterprise is that people leave. Your IdP already handles that moment well for humans: Okta can automatically deactivate downstream app accounts when a user is deactivated, and Microsoft Entra ID Governance offers leaver workflows built for exactly this transition. Badges stop working by the afternoon. But the agents that person created, approved, and quietly wired into production? Few organizations can even list them, let alone decide their fate. They keep running, keep authenticating, and answer to no one.

The security industry has already named this failure. OWASP’s Non-Human Identities Top 10 ranks improper offboarding as the number one risk, ahead of every leak and misconfiguration on the list. The Cloud Security Alliance found that only 20% of organizations have formal processes for offboarding and revoking API keys, and in a January 2026 survey, 78% reported no documented, formally adopted policy for creating or removing AI identities. The cost of getting it wrong for even one account is already on record: CISA’s February 2024 advisory traced a breach of a state government organization to a former employee’s admin account that, in the advisory’s words, “was not disabled immediately following the employee’s departure.” That was one human login. Now multiply it by every agent and sub-agent that employee ever spawned.

AgentID will listen for the same offboarding signals your IdP already sends, so a departure will no longer be a blind spot. It will be a decision point. All of that person’s agents will be suspended at once, and your own policy will decide what happens next:

When Something Goes Wrong

Ownership chains earn their keep on bad days, and we will be honest about those days: none of what follows prevents an attack from starting. What it can do is limit what a compromised agent can do through the AI Gateway, and how quickly you can cut that off.

If the human turns.Insider abuse is the oldest problem in security, now with machine reach attached. When an employee’s intent or credentials go bad, the ownership chain will give the response a boundary drawn in advance: once the abuse is seen, you will know every agent anchored to that person, and you can revoke each one’s identity so it can no longer act through the AI Gateway. The insider can still act alone; their agents can no longer act for them there.

If the agent is compromised. We wrote in FN-04 that you cannot reliably stop an agent from being tricked; you can only decide what the trick is worth. A hijacked agent is not a villain, it is a governed identity being steered by someone else’s instructions, and the response is surgical: revoke that agent’s identity, and those of the sub-agents working under it, so none of them can act through the AI Gateway, without touching any other agent or its owner’s own access. Then the lineage becomes the investigation’s map: which agent it works for, what it was set up to reach, and when it was invoked, from the providers’ own logs. Once owners are linked, the map will also name the agent’s owner.

Who Pays for This Agent?

There is a second question an agent identity can feed into, and it is the one the CFO asks. Agents rack up real costs: model tokens, compute, API calls, the transactions they execute. In most companies that spend lands in undifferentiated cloud and vendor bills, and the person staring at them cannot say which agent spent what, for whom, or why. The identity layer can supply part of the missing half: which agent identity took an action through the AI Gateway and, once owners are linked, on whose authority.

Once each agent and sub-agent acts under its own identity, every call it sends through the AI Gateway carries that identity. Arkion does not calculate or attribute spend; that work stays in your cost tools.

The timing matters. In the FinOps Foundation’s 2026 survey of nearly 1,200 cloud-spend practitioners, 98% said they now manage AI spend, up from 31% two years earlier. They named allocating AI costs to business units among their top challenges, calling it harder than it ever was for traditional infrastructure, and their single most requested tooling capability was granular monitoring of AI spend, down to tokens and individual model requests. Grain that fine needs an identity on every action.

Professional services firms will feel this first, because their billing is already governed. Bar guidance has long required that costs billed to a client be the actual amounts paid on the client’s behalf, with no undisclosed markup. In July 2024, the ABA’s first formal ethics opinion on generative AI extended that discipline to machines: a lawyer billing hourly must bill actual time, not the time the tool saved, and a per-use AI service engaged for a particular client is ordinarily billable to that client as an expense, at cost. Meanwhile, 68% of corporate legal professionals say they do not know whether their outside firms use AI. Put those together and every managing partner meets the same question: how do you prove what an agent actually did, and what it actually cost, on a particular matter?

Give each agent its own identity, and one part of that question gets easier: which agent acted, for calls through the AI Gateway and in the providers’ own logs. Cost and matter records stay in your billing systems. It is the same verified-agent idea we described in FN-03, pointed at billing.

Why We Built Arkion

Two truths sit in tension. Machine environments are decentralized and fast: identities issued, rotated, and retired at machine pace. The signing engine we benchmarked in FN-09 ran at tens of thousands of signatures a second. Accountability is centralized and human: a name, a decision, a person answerable for what acts under their authority, and for what it spends. Most platforms pick one. Speed without a chain of command gives you an ungoverned swarm. A chain of command without speed gives you a bottleneck the business will route around.

Arkion exists to build that intersection: certificates issued and revoked at machine speed, in a decentralized environment, and a chain of ownership from every recorded sub-agent to the human being your IdP already knows. That is the level of command and governance we believe the agentic enterprise requires, and it is the reason this company was built.