Karina Portugal Makes the Case for Know Your Agent

As AI agents increasingly act autonomously on behalf of users and organizations, traditional identity verification methods like KYC fall critically short — they authenticate at entry but not throughout execution. A compromised or malicious AI agent that has obtained legitimate credentials can perform authorized-looking actions that are actually harmful, bypassing perimeter-based controls entirely. This represents a fundamental gap in access control philosophy: authentication is a moment-in-time check, but authorization must be continuous. The rise in AI-driven fraud demonstrates that threat actors are already exploiting this blind spot at scale. Organizations must rethink identity and access frameworks to account for non-human agents as first-class principals requiring ongoing verification.