What the major platforms actually ship today<\/h2>\n
Neither of the two most widely deployed agent platforms issues agents their own credentials in the hosted product. Anthropic and OpenAI both allow a developer to hand an agent a static bearer token through their APIs, which is far from a proper identity, and ChatGPT connectors reject service accounts and JWT assertions outright. The result is that AI systems hold full standing privileges right-sized for humans, and the logs are written under the human’s name.<\/p>\n
Google previewed a different model in May 2024. The Workspace agent demo, named Chip, had its own Workspace account, a designated role, configured permissions, and stated objectives, and it joined chat rooms under that identity. The Workspace VP said at the time that a lot of work remained before agentive experiences like virtual teammates could reach the product. Chip stayed a demo. What Google and its competitors shipped instead are agents that inherit a human’s authority.<\/p>\n
How coworker behavior outpaces the OAuth consent model<\/h2>\n
OAuth assumes a human reads a consent screen and approves a fixed list of scopes, and that assumption is breaking. Agents discover tools at runtime and try to use them, so the fixed scope granted at the start rarely covers what the agent ends up needing. Confirming sensitive actions every few minutes is both annoying and a security risk, because there is only so much human attention to go around. The product lead for ChatGPT Work and Codex has described what makes an agent useful in the same terms: access to data, cloud infrastructure, and reliability, with the analogy that locking a hired colleague in a room with no access to documents, chat, or the company database makes the colleague useless. An isolated cloud agent is useless for the same reason, which means the route to a useful coworker runs through the same systems a human employee touches.<\/p>\n
That requirement reaches further when an agent spawns sub-agents to parallelize work, and when one person’s agent hands work to another person’s agent across teams. Those handoffs are governable only if the coworker holds an identity of its own.<\/p>\n
What vendors are shipping for agent identity<\/h2>\n
The platform vendors have started adapting. Microsoft shipped Entra Agent ID with first-class agent identities and a named human sponsor. Okta added agent identities to Universal Directory, with short-lived, scoped tokens and a revocation path. SailPoint and CyberArk have comparable offerings. Each of these secures agents inside its own estate, and for organizations that want to stay platform-agnostic, identity controls are the de facto checkpoint where policies can be enforced, because identity governs access to every action.<\/p>\n
Five things to do before the third wave arrives<\/h2>\n\n- Find the shadow coworkers.<\/strong> Registration only captures agents that someone remembered to register, so detection has to run on authentication traffic, OAuth grants, and API key use.<\/li>\n
- Give every persistent agent an identity of its own.<\/strong> If an agent authenticates as a human, no downstream control can tell the two apart and no investigation can correctly attribute the action.<\/li>\n
- Record a human owner.<\/strong> Orphaned agents with live credentials are the most common source of agent-related standing privilege.<\/li>\n
- Scope access to the agent, not to the person who started it.<\/strong> An agent that reads Jira should not hold a token that also writes to the cloud provider just because the engineer who launched it happened to hold both.<\/li>\n
- Decide in advance when it dies.<\/strong> Persistent agents are not project-based, but they still need a written end condition, such as a team disbandment, an owner leaving, or an idle period that triggers automatic retirement.<\/li>\n<\/ul>\n
For organizations that want a structured way to track where their own agent identities are running, an AI visibility scan can surface which AI agents and MCP servers are active in an environment and which credentials they are using. SEOScanPro’s AI Agent Readiness check is one way to see whether the site itself is readable and usable to the agents that will soon be coworkers on the other side of the request.<\/p>\n
What the third wave asks of the security team<\/h2>\n
Wave one needed output controls. Wave two needed access controls and approvals around a human in the loop. Wave three takes the human away and leaves the access in place, and the pressure is about to rise. One person’s coworker will hand work to another person’s coworker, and those handoffs only stay governable when the coworker carries its own badge. Give it an identity before you give it a job.<\/p>\n
FAQ<\/h2>\nWhat is the third wave of AI work?<\/h3>\n
The third wave is persistent AI coworkers, agents that hold their own state across sessions, accumulate access over time, and act without a human in the loop. It follows session-scoped chat, where the risk was the model’s output, and task-scoped agents, where the risk was the model’s action.<\/p>\n
Why do current access models break for AI coworkers?<\/h3>\n
OAuth assumes a human approves a fixed list of scopes, agents discover tools at runtime and use them, and persistent agents accumulate grants from project after project. Combined grants can exceed anything a human intended to give, and audit trails record the human who started the agent rather than the machine.<\/p>\n
What is the first step to secure persistent agents?<\/h3>\n
Find the shadow coworkers by looking at authentication traffic, OAuth grants, and API key use, since registration only captures agents that someone remembered to register. Then give each persistent agent its own identity, record a human owner, scope access to the agent rather than the launcher, and write a retirement condition into the agent at creation.<\/p>\n
SEOScanPro<\/h2>\n
![\"SEOScanPro,](\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\")
<\/a><\/p>\nSEOScanPro has the AI visibility report runs a full technical audit of a site and shows the measured result behind every check. Open the AI visibility report<\/a>.<\/p>\n
For organizations that want a structured way to track where their own agent identities are running, an AI visibility scan can surface which AI agents and MCP servers are active in an environment and which credentials they are using. SEOScanPro’s AI Agent Readiness check is one way to see whether the site itself is readable and usable to the agents that will soon be coworkers on the other side of the request.<\/p>\n
What the third wave asks of the security team<\/h2>\n
Wave one needed output controls. Wave two needed access controls and approvals around a human in the loop. Wave three takes the human away and leaves the access in place, and the pressure is about to rise. One person’s coworker will hand work to another person’s coworker, and those handoffs only stay governable when the coworker carries its own badge. Give it an identity before you give it a job.<\/p>\n
FAQ<\/h2>\nWhat is the third wave of AI work?<\/h3>\n
The third wave is persistent AI coworkers, agents that hold their own state across sessions, accumulate access over time, and act without a human in the loop. It follows session-scoped chat, where the risk was the model’s output, and task-scoped agents, where the risk was the model’s action.<\/p>\n
Why do current access models break for AI coworkers?<\/h3>\n
OAuth assumes a human approves a fixed list of scopes, agents discover tools at runtime and use them, and persistent agents accumulate grants from project after project. Combined grants can exceed anything a human intended to give, and audit trails record the human who started the agent rather than the machine.<\/p>\n
What is the first step to secure persistent agents?<\/h3>\n
Find the shadow coworkers by looking at authentication traffic, OAuth grants, and API key use, since registration only captures agents that someone remembered to register. Then give each persistent agent its own identity, record a human owner, scope access to the agent rather than the launcher, and write a retirement condition into the agent at creation.<\/p>\n
SEOScanPro<\/h2>\n
SEOScanPro has the AI visibility report runs a full technical audit of a site and shows the measured result behind every check. Open the AI visibility report<\/a>.<\/p>\n![\"SEOScanPro,](\"https:\/\/seoscanpro.ai\/shots\/og-home.jpg\")
<\/a><\/p>\n