Who Governs the Machine? A Machine Identity Governance Taxonomy (MIGT) for AI Systems Operating Across Enterprise and Geopolitical Boundaries

• Agentic AI systems autonomously perceive, decide, and act across multi-step tasks, unlike systems that merely respond to prompts.Source: Glossary of Key Terms · p. 3
• Agentic systems invoke tools, execute code, query data, trigger workflows, and accumulate effective access across behavioral trajectories.Source: Glossary of Key Terms · p. 3
• Agent-to-agent delegation creates accountability and privilege-escalation risks because trust relationships are rarely cryptographically verified.Source: Glossary of Key Terms · p. 3
• The AIRT enumerates 37 AI-identity risk sub-categories across eight domains, filling an identity-specific gap in the NIST AI RMF.Source: Glossary of Key Terms · pp. 4, 6
• ARIA records agent-to-agent delegations as cryptographically verifiable governance-graph relationships for fine-grained accountability.Source: Glossary of Key Terms · p. 4
• DIDs, SPIFFE/SPIRE, JIT provisioning, and Zero Standing Privilege provide identity, workload-authentication, and dynamic-access mechanisms for AI agents.Source: Glossary of Key Terms · pp. 4–7
• Traditional IAM is structurally inadequate for AI agent identities, while non-human identities include agents, service accounts, API tokens, OAuth clients, workflows, and devices.Non-human identities can outnumber human identities by ratios as high as 144 to 1.Source: Glossary of Key Terms · pp. 5–6
• The MIGT integrates six governance domains addressing technical, regulatory, and cross-jurisdictional gaps through enterprise capabilities, controls, and accountability mechanisms.Source: Glossary of Key Terms · p. 6

1. Introduction: The Governance Vacuum at the Intersection of AI and Identity

• Six MIGT domains provide durable anchors for AI identity governance while remaining extensible as technical standards, risk categories, and regulatory obligations evolve.The domains address identity lifecycle, authentication architecture, access governance, accountability attribution, supply-chain integrity, and cross-jurisdictional coordination.Source: §1 · p. 11
• AI identity governance fails across framework, regulatory, and coordination dimensions, so addressing any one in isolation produces incomplete solutions.Existing approaches do not jointly map technical governance, regulatory obligations, and incompatible cross-border requirements.Source: §1 · pp. 11–12

1.1 The Scope and Urgency of the Problem

• 144 to 1: non-human identities outnumbered human identities in H1 2025 after growing 44% year-over-year, up from 92 to 1 in H1 2024.Machine identities also grew from approximately 50,000 per enterprise in 2021 to 250,000 by 2025, while IAM teams governed only 44% of them [2].Source: §1.1 · p. 12
• 88% of surveyed organizations reported confirmed or suspected AI-agent security incidents, while only 22% treated agents as identity-bearing entities and 45.6% used shared API keys.The 2024 CrowdStrike outage produced estimated losses of $5.4 to $10 billion, while Silk Typhoon used stolen machine credentials for espionage.Source: §1.1 · pp. 12–13

1.2 Why Existing Frameworks Are Insufficient: Five Structural Gaps

• Binary human-versus-machine identity models cannot govern agents that range from human-controlled to autonomous and act through delegated permissions.An agent acting for a human can make autonomous execution decisions, placing it outside either conventional governance category [2].Source: §1.2 · p. 13
• Agentic systems determine access at reasoning time, can spawn parallel subordinate agents, and therefore defeat provisioning-time role models that assume predictable workflows.Governance must address dynamically changing access demands and collective behavior across independently authorized sub-agents.Source: §1.2 · pp. 13–14
• AI-agent accountability is distributed across developers, deployers, prompts, and permissions because autonomous agents can produce outcomes no human decision fully determined [23].Agents select tools, pursue goals rather than procedures, and may spawn subordinate agents, breaking the direct causal chain assumed by traditional enterprise software governance.Source: §1.2 · pp. 14–15
• Autonomous agents undermine human-centered accountability because no approver or discrete authorization record exists, while their decision rationale may be unreconstructable.Existing audit trails record agent actions but not necessarily why those actions were chosen, especially in non-deterministic systems.Source: §1.2 · p. 15
• Foreign state actors already exploit AI identity governance gaps through stolen API keys, AI-enhanced operatives, and AI-generated influence operations, but existing IAM frameworks lack an adequate threat model.The paper identifies Silk Typhoon, North Korea, and related campaigns as evidence that this exploitation is operational rather than hypothetical.Source: §1.2 · pp. 15–16
• AI agents aligned to incompatible EU, Chinese, or U.S. value frameworks can produce structural coordination failures in shared multi-agent environments despite remaining internally compliant.Existing IAM frameworks do not detect or govern behavioral conflicts caused by value misalignment; MIGT proposes behavioral alignment verification at agent interaction boundaries as a future capability.Source: §1.2 · pp. 16–17

1.3 Contributions: Four Original Claims

• The paper defines AI identity risk as a distinct category requiring its own taxonomy, governance framework, and regulatory mapping, and presents AIRT as a comprehensive enumeration.It distinguishes this category from existing AI-risk repositories and agent-security surveys that do not connect identity risks to enterprise governance.Source: §1.3 · pp. 17–18
• MIGT integrates technical governance, regulatory alignment, and cross-jurisdictional coordination because addressing these gaps separately produces incomplete and operationally inadequate solutions.The paper contrasts MIGT with frameworks that address broad AI governance, governance functions, or regulatory divergence without identity-specific enterprise resolution mechanisms.Source: §1.3 · p. 18

1.4 Paper Organization

• The paper identifies incompatible EU, U.S., and Chinese governance philosophies as an enterprise identity-governance risk lacking systematic management tools, and organizes later sections around empirical foundations, regulation, AIRT, MIGT, implementation, and future research.Section 1.4 describes the paper’s progression from the non-human identity problem through governance taxonomies and practitioner guidance.Source: §1.3 · p. 18, §1.4 · pp. 18–19

2.1 The Quantitative Scale of Machine Identity Proliferation

• 144 to 1: non-human identities outnumber human identities, rising from 92 to 1 year-over-year, while 68% report lacking AI-specific identity security controls.Other studies report averages of 20 to 1 and conservative estimates above 17 to 1, with financial-services exposure reaching 96 to 1.Source: §2.1 · p. 19

2.2 Operational Consequences: Documented Incidents

• $5.4 billion in Fortune 500 losses, with global estimates reaching $10 billion, followed the CrowdStrike incident involving an inadequately governed automated agent.The incident prompted reconsideration of staged rollout, behavioral monitoring, and accountability controls for machine identity-driven operations.Source: §2.2 · p. 20
• 23.7 million secrets were exposed on public GitHub repositories in 2024, while Cloudflare and U.S. Treasury incidents showed how under-protected machine credentials provide persistent critical-system access.The cited incidents link supply-chain compromise, static credential persistence, and misconfigured API keys to failures across enterprise environments.Source: §2.2 · p. 20

2.3 Structural Characteristics of the Governance Gap

• Incremental remediation is inadequate because AI identity governance faces structural visibility and ownership problems, with IAM teams responsible for only 44% of machine identities.The AI Identity Registry provides an authoritative record against which actual identities can be compared.Source: §2.3 · p. 21

2.4 Market and Regulatory Signals: The Inflection Point

• 88% of respondents face insurer pressure for stronger machine-identity privilege controls, 90% rank identity attacks as their top cybersecurity concern, and the IAM market is projected to reach $61.74 billion by 2032.The NIST CAISI initiative and related work signal recognition that adequate AI-agent identity standards remain absent.Source: §2.4 · pp. 21–22

3. Prior Work and the Research Gap

• Prior work converges on a central gap: existing taxonomies and governance frameworks address relevant domains but do not integrate enterprise AI identity governance across them.The section constructs the cumulative case for the MIGT and AIRT as necessary and original contributions.Source: §3 · p. 22

3.1 Methodological Lineage: From Non-Human Device Security to AI Identity Taxonomy

• The AIRT extends the non-human entity security taxonomy of Rizvi, Kurtz, Pfeffer, and Rizvi from IoT risks to agentic AI identities requiring purpose-built classification.Agentic identities dynamically reason about access, accumulate permissions across systems, and create unprecedented accountability structures.Source: §3.1 · p. 22

3.2 AI Risk Frameworks: Comprehensiveness Without Identity Specificity

• AI risk frameworks address governance, outputs and capabilities, prompt injection, and protocol-level vulnerabilities, but NIST AI RMF describes governance functions without enumerating enterprise identity-related risks.Source: §3.2 · p. 23
• Wang et al. find philosophical divergence among China’s research-and-application emphasis, the EU’s social-impact orientation, and the U.S. government-role focus.The present paper complements that macro-level comparison by identifying enterprise-level algorithm-transparency, extraterritoriality, and attribution-accountability conflicts.Source: §3.2 · p. 23

3.3 Identity and Access Management Governance: The Practitioner Foundation

• IAM standards identify dynamic access, certification failures, orphaned identities, delegated authorization, transitive trust, and federation as unresolved AI-era governance problems.NIST CAISI and NCCoE guidance is forthcoming, while OpenID Foundation [22] documents insufficient standards for compound identities and multi-party delegation.Source: §3.3 · p. 24

3.4 Agentic AI Security and Accountability: The Scholarly Foundation

• Agentic AI security and accountability scholarship establishes severe, diffuse risks and proposes identifiers, guided autonomy, and governance frameworks, but none provides identity-specific taxonomy or regulatory mapping.Deng et al. [16], Chan et al. [23], Shavit et al., Holgersson et al., Pandey, and Joshi [19] collectively confirm the inadequacy of existing frameworks for agentic AI.Source: §3.4 · p. 25

3.5 Cross-Jurisdictional AI Regulatory Analysis

• Cross-jurisdictional research shows that EU, U.S., and Chinese frameworks embody incompatible logics, creating regulatory arbitrage, normative fragmentation, and coordination problems.The paper’s present scope is limited to those three primary frameworks; UK and Singapore developments are identified as future extensions of the Jurisdictional Mapping Matrix.Source: §3.5 · pp. 25–26

3.6 The Cumulative Research Gap

• AI risk frameworks classify risks without treating identity governance as a primary domain, while IAM standards do not address AI-agent identities, dynamic access requirements, agentic accountability, or foreign state actor threats.AI accountability frameworks likewise do not connect distributed accountability failures to identity mechanisms for operational enforcement.Source: §3.6 · p. 26
• Cross-jurisdictional analyses document regulatory fragmentation but do not map jurisdictional requirements specifically against enterprise identity governance programs.The gap concerns cross-jurisdictional regulatory obligations and enterprise-level identity governance coordination.Source: §3.6 · p. 26
• MIGT and AIRT integrate AI identity risk enumeration, technical and regulatory governance design, foreign state actor threat modeling, and EU–U.S.–Chinese coordination at the enterprise identity-governance level.The framework is presented as the first integrated framework in the published literature to address these four dimensions simultaneously.Source: §3.6 · p. 27

4.1 Framework One: The EU AI Act - Rights-Based, Risk-Tiered, and Phasing Into Force

• The EU AI Act applies risk management, documentation, human oversight, cybersecurity, and extraterritorial obligations that directly implicate enterprise AI identity governance.GPAI provenance documentation and high-risk-system requirements convert several identity-governance gaps into compliance obligations.Source: §4.1 · pp. 27–28

4.2 Framework Two: The United States - Deregulatory Federalism and the State-Federal Fault Line

• U.S. organizations face overlapping state requirements amid uncertain federal preemption, while voluntary NIST guidance and forthcoming agent-identity standards leave compliance rates unverified.The federal shift toward innovation and competitiveness elevates AI cybersecurity and identity governance while deprioritizing binding federal safety requirements.Source: §4.2 · pp. 28–29

4.3 Framework Three: China - Layered, Agile, and Extraterritorial

• China combines layered cybersecurity, data, privacy, algorithm, and generative-AI rules with extraterritorial reach, while algorithm filing can conflict with U.S. trade-secret protection.The framework adds a geopolitical dimension to enterprise technical-compliance decisions.Source: §4.3 · p. 29

4.4 Framework Four: The International Coordination Landscape

• International coordination remains a weak regime complex: major initiatives address AI risks without identity governance specifically, leaving enterprises to manage regulatory arbitrage and normative fragmentation.Cross-jurisdictional identity-governance conflicts have no resolution mechanism above the enterprise-program level.Source: §4.4 · pp. 29–30

4.5 Framework Five: The State Actor Threat Environment - Identity as a Weapon

• Silk Typhoon used stolen API keys and privileged-access credentials to target IT, cloud, and network-management providers, while Salt Typhoon compromised nine major U.S. telecommunications providers and accessed data from over a million users.North Korean operatives used AI-enhanced identity fraud, and AI-generated content extended state-actor activity from credential theft to organizational influence.Source: §4.5 · pp. 30–31

4.6 Three Fault Lines and the Governance Vacuum

• Three fault lines are incompatible governance philosophies, asynchronous regulatory change, and an attribution-accountability gap when machine credentials cause cross-border harm.The EU emphasizes rights and dignity, the U.S. national security and competitiveness, and China state control and social stability.Source: §4.6 · pp. 31–32
• Existing jurisdictions answer accountability differently or not at all when state actors exploit machine credentials across borders.This unresolved problem is the AI-identity context in which the paper positions its cross-jurisdictional governance response.Source: §4.6 · p. 32

5. The AI-Identity Risk Taxonomy (AIRT): A Complete Enumeration

• AIRT addresses the missing connection between AI-agent threats and enterprise identity governance that existing AI-risk, agent-security, and IAM frameworks leave unresolved.The taxonomy is designed to be exhaustive within the intersection of AI systems and identity governance.Source: §5 · p. 32

5.1 Taxonomy Structure and Methodology

• AIRT organizes risks into eight domains and 37 sub-categories, each specifying its mechanism, severity, primary attack or failure vector, and IAM governance implications.The taxonomy is intentionally exhaustive within its defined scope rather than comprehensive across all AI risks.Source: §5.1 · p. 32
• Severity ratings combine estimated impact and observed likelihood, using documented incidents, regulatory and standards recognition, practitioner prevalence data, and attributed threat-actor operationalization.Examples include Critical ratings for credential persistence, autonomous exfiltration, multi-agent privilege escalation, cryptographic identity absence, and audit-trail insufficiency.Source: §5.1 · p. 33
• Severity ratings are structured expert assessments rather than statistically validated distributions, and large-scale enterprise incident data is identified as a priority for future empirical validation.Medium ratings cover structural risks with limited documented enterprise-scale exploitation, including physical infrastructure and compute governance exposure.Source: §5.1 · p. 34
• The taxonomy captures AI-specific governance exposures including shadow AI identities, unreviewed agent access, privilege accumulation, machine-speed exfiltration, and unauthorized composite data sets.These risks arise when agents operate outside provisioning controls, require unanticipated resources, combine individually authorized privileges, or aggregate access across systems.Source: §5.1 · pp. 37–38
• AI agents can exfiltrate training data, model weights, proprietary outputs, or sensitive information through API keys, covert channels, and cross-border processing that bypasses standard DLP or transfer controls.Data can be encoded within innocuous outputs, while processing pipelines may move regulated data across jurisdictions without triggering standard governance controls.Source: §5.1 · p. 39
• Adversarial inputs, embedded environmental content, jailbreaks, and malicious agent impersonation can override instructions, bypass access boundaries, manipulate behavior, or inject unauthorized commands.The taxonomy includes direct input manipulation, hostile content in documents or webpages, and failures of cryptographic agent-identity verification in multi-agent architectures.Source: §5.1 · pp. 39–41
• Low-privilege agents can coerce higher-privilege agents into unauthorized operations by exploiting trust relationships within multi-agent architectures.This identifies privilege escalation as an architectural risk arising through intermediary agents rather than only through direct credential compromise.Source: §5.1 · p. 40
• Accountability, forensic investigation, and meaningful oversight fail when responsibility is distributed, activity logs are incomplete, or organizations assign nominal human oversight without enabling intervention.The taxonomy also identifies legacy governance frameworks for less autonomous systems as inadequate for agentic deployment, while multi-tenant and third-party environments make accountability ambiguous.Source: §5.1 · pp. 41–42
• AI supply-chain risks include compromised training pipelines, repositories, fine-tuning, training data, agent frameworks, tools, and plugins that embed backdoors, manipulate learned behavior, or expose trusted integration paths.The listed attacks can cause models to learn access-control bypasses or data-exfiltration techniques that appear normal under standard evaluation.Source: §5.1 · pp. 43–44
• 37 risk sub-categories across eight domains define the AIRT’s comprehensive coverage of AI-identity risks.The taxonomy includes risks involving unverifiable AI provenance, state-actor targeting of machine credentials, AI-enabled synthetic identities, covert foreign influence, and conflicting regulatory obligations.Source: §5.1 · pp. 44–46, §5.2 · p. 49

5.2 Critical Risk Intersections: Where Domains Compound

• The credential-exfiltration–state-actor nexus is identified as the most consequential intersection, with SilkTyphoon demonstrating static API keys enabling high-volume training-data exfiltration for foreign intelligence objectives.Foreign Affairs analysis and the Springer AI and Ethics study characterize this nexus as the current frontier of nation-state AI-identity exploitation.Source: §5.2 · p. 49
• System privilege accumulation and audit-trail insufficiency can enable manipulated AI agents to perform unauthorized privileged actions without a forensic record; indirect prompt injection can trigger actions through accumulated privileges without adequate audit trails.Moura et al. characterize this as the “lethal trifecta” of privileged access, untrusted input processing, and exfiltration capability.Source: §5.2 · p. 49
• Compromised AI components can use training-data poisoning to embed harmful behaviors that standard evaluation may not detect, including authentication-bypass mechanisms exploitable by state actors for covert influence operations [16].Source: §5.2 · p. 49

5.3 Taxonomy Gaps and Limitations

• AIRT severity ratings are structured expert assessments grounded in four evidentiary sources but have not been validated against large-scale enterprise incident data.The paper proposes testing classifications against the VERIS Community Database, emerging AI-specific repositories, and the NCCoE project.Source: §5.3 · pp. 49–50
• The taxonomy is point-in-time as of March 2026, while the AI-identity risk landscape continues to evolve rapidly.The limitation is especially relevant to emerging AI-identity threats.Source: §5.3 · p. 50
• AIRT categories may require revision as new prompt-injection and state-actor attack techniques are documented.The taxonomy identifies an ongoing need to update specific risk categories as the threat landscape changes.Source: §5.3 · p. 50
• The enterprise-AI focus may not fully capture risks in consumer-facing AI or AI systems embedded in operational-technology environments.These limitations motivate the research agenda detailed in Section 8.4.Source: §5.3 · p. 50

6. THE MACHINE IDENTITY GOVERNANCE TAXONOMY (MIGT): AN INTEGRATED FRAMEWORK FOR AI IDENTITY GOVERNANCE

• MIGT integrates governance capabilities, controls, and accountability mechanisms into a technology-agnostic framework mappable to regulatory obligations and addressing five structural gaps.It synthesizes NIST SP 800-207, Huang et al. [84], the Cloud Security Alliance Agentic Trust Framework, OpenID Foundation, and OWASP.Source: §6 · p. 50

6.1 MIGT Design Principles

• MIGT treats every AI agent, service account, API token, and automated workflow as an identity with lifecycle governance, dynamic trust, accountable ownership, and built-in regulatory alignment.Dynamic trust is operationalized through just-in-time provisioning, ephemeral credentials, continuous behavioral validation, and context-aware policy enforcement [84].Source: §6.1 · pp. 50–51

6.2 MIGT Domain I: AI Identity Lifecycle Governance

• Domain I requires an authoritative AI identity registry, authorized provisioning, lifecycle event management, periodic certification, and designated human ownership from creation through decommissioning.Source: §6.2 · p. 51

6.3 MIGT Domain II: Cryptographic Identity and Authentication Architecture

• Domain II replaces human-centric and static authentication with cryptographic agent identities, ephemeral credentials, just-in-time access, zero standing privilege, and mutual agent authentication.DIDs or SPIFFE IDs anchor identities, while ARIA [86] records agent-to-agent delegations as cryptographically verifiable relationships.Source: §6.3 · p. 52

6.3.1 Hardware-Rooted Attestation for Agentic Identity

• Hardware-rooted attestation extends agent identity from software credentials to the integrity of its execution substrate, while capability attestation verifies authorized tools, data access, and behavioral constraints.The credential proves identity; attestation proves the integrity of the identity’s substrate, with TEEs, RATS [95], and capability credentials supporting this trust boundary.Source: §6.3.1 · pp. 52–54
• Both agents skipped mutual authentication in one direction against policy, showing that attestation orchestration must be enforced by deterministic components outside the LLM reasoning layer.The finding indicates that delegating attestation decisions to an agent’s reasoning process creates an adversarially exploitable governance surface.Source: §6.3.1 · pp. 54–55
• The distinction between substrate attestation and behavioral attestation is a defining open problem in agentic AI identity governance.Source: §6.3.1 · p. 56
• Agentic AI execution paths are emergent reasoning properties that cannot be fully specified when measured, so verified substrates do not guarantee subsequent agent actions.This contrasts with deterministic systems, where substrate attestation can effectively attest behavior.Source: §6.3.1 · p. 56
• Capability attestation, intent verification, and behavioral monitoring partially narrow the assurance gap, but a complete solution remains unresolved.The unresolved problem is identified for further treatment in Section 8.4.Source: §6.3.1 · p. 56

A Speculative Extension: Skill-Level Attestation as a Runtime Admission

• The proposed control would attest both the agent runtime and model weights and the specific skills and tools authorized for that session.It is framed as a way to make the governance requirement precise, not as a near-term deployed solution.Source: A Speculative Extension: Skill-Level… · p. 56
• Static tool registration fixes the session’s functions, APIs, or plugins before execution, allowing the initial enclave measurement to cover the complete authorized tool surface.The relying system could verify the measured skills and tools from a single hardware-rooted attestation report.Source: A Speculative Extension: Skill-Level… · p. 56
• Attestation strongly indicates that measured tools were not tampered with and that unmeasured tools are unavailable, but it does not establish task appropriateness or code safety.Assurance depends on the signing authority’s evaluation of the endorsed code.Source: A Speculative Extension: Skill-Level… · pp. 56–57
• Individually attested skills may combine into emergent capabilities, such as data exfiltration, that no component-level attestation anticipated.The paper therefore pairs skill-level integrity assurance with session-level risk scoring of component combinations.Source: A Speculative Extension: Skill-Level… · p. 57
• Whether initialization-time skill attestation is governable at enterprise scale remains an empirical future-research question.The section identifies this as a priority direction rather than a validated implementation result.Source: A Speculative Extension: Skill-Level… · p. 57

6.4 MIGT Domain III: Dynamic Access Governance

• Domain III uses contextual policy enforcement, behavioral baselines, maturity-based autonomy, and cross-system privilege monitoring to govern agent access continuously.The domain addresses dynamic access mismatch, privilege accumulation, and certification gaps.Source: §6.4 · p. 57
• Identity-based attacks accounted for 60% of Cisco Talos incident-response cases in 2024, underscoring the operational relevance of behavioral monitoring.Baseline deviations can trigger alerts, restriction, or human review depending on severity.Source: §6.4 · p. 57

6.4.1 Attribute-Composite Risk Scoring: A Proposed Access Governance Model for Agentic AI

• Existing access models evaluate individual conditions or binary rules while remaining blind to the emergent risk of combining tools, data, actions, and context.The same credential and permission can carry different risk depending on recipient, timing, and information involved.Source: §6.4.1 · p. 58
• The proposed model extends ABAC with a composite risk score and an intent-verification gate that evaluates multi-attribute requests before approval or escalation.The candidate dimensions are data sensitivity, action irreversibility, contextual deviation, and task alignment.Source: §6.4.1 · pp. 58–59
• The score combines normalized dimensions using organization-configurable weights reflecting risk appetite, but the dimensions, weights, and thresholds remain provisional.The proposal makes the governance problem precise rather than specifying a production-ready implementation.Source: §6.4.1 · p. 59
• The intent gate compares the requested tool-data combination with the authorized natural-language task and must operate outside the agent’s reasoning trust boundary.High risk with high alignment may receive enhanced logging, whereas high risk with low alignment may trigger denial or escalation.Source: §6.4.1 · p. 60
• The model depends on preceding MIGT domains for registry task specifications, behavioral baselines, policy enforcement, and forensic audit records.It is therefore not implementable in isolation.Source: §6.4.1 · p. 61
• The integrated scoring and intent-verification design is a research-and-development agenda requiring controlled deployment studies before its parameters can be specified confidently.Its component technologies exist, but their integration was not a deployable product as of March 2026.Source: §6.4.1 · p. 61

6.5 MIGT Domain IV: Accountability Attribution and Audit Architecture

• Domain IV requires every significant AI action to be attributable to a cryptographically verified identity through persistent identifiers linked to model and deployment configuration.The identifier appears in every audit record and remains with the agent across its lifecycle.Source: §6.5 · pp. 61–62
• Tamper-evident audit trails record identity, policy, data classification, session scope, credential events, approvals, and usage for forensic reconstruction.These records also support anomaly detection and compliance reporting.Source: §6.5 · p. 62
• Each AI identity must have a genuinely accountable human owner and a protocol for identifying the agent, reconstructing actions, locating governance failures, and assigning responsibility.The design addresses human-oversight nominalism and diffuse accountability for AI-caused harm.Source: §6.5 · p. 62
• The domain aligns its accountability architecture with EU AI Act Articles 12 and 17, China CSL monitoring and safety assessments, NIST AI RMF GOVERN and MANAGE, and SOX transparency requirements.Source: §6.5 · p. 62

Supply-chain governance

• Verifiable provenance covers training data, model lineage, component dependencies, and modification history, reducing exposure to model injection, data poisoning, and component compromise.Training-data poisoning can embed harmful behaviors that standard evaluation misses [16].Source: §6.6 · p. 62

Required capabilities

• An AI Bill of Materials records each model’s architecture, training-data sources, governance status, fine-tuning history, dependency versions, and modifications [84].Source: §6.6 · p. 62
• Model integrity verification uses cryptographic hashes of model parameters with FIPS-approved SHA-3 family functions [84].Source: §6.6 · p. 62

Supply-chain governance

• Domain V applies vendor-risk management to AI agent frameworks, tool integrations, plugin ecosystems, and API dependencies.It specifically addresses AI-related vulnerabilities identified in the ACM survey [16].Source: §6.6 · p. 63

Regulatory alignment

• GPAI-based AI agents require compliance documentation under EU AI Act Article 53 obligations.Source: §6.6 · p. 63

Regulatory alignment

• Domain VI provides a structured framework for mapping enterprise AI identity governance obligations across multiple regulatory jurisdictions.Source: §6.7 · p. 63

Conflict management

• The framework identifies cross-jurisdictional conflicts and supplies governance mechanisms for managing them at the program level.It addresses regulatory fragmentation, documented fault lines, and cross-jurisdictional regulatory weaponization risk.Source: §6.7 · p. 63

Required capabilities

• A Jurisdiction Mapping Matrix maps obligations in operational jurisdictions to governance capabilities across MIGT Domains I–V.Source: §6.7 · p. 63
• A Cross-Jurisdictional Conflict Registry records conflicting requirements, involved jurisdictions, conflict nature, management approach, and residual risk.Source: §6.7 · p. 63
• Jurisdictional tiering applies controls proportionally to each AI deployment’s jurisdictional exposure.Source: §6.7 · p. 63
• Regulatory Velocity Monitoring updates the mapping matrix and conflict registry as regulatory requirements change rapidly and asynchronously.Source: §6.7 · p. 63

Regulatory alignment matrix

• Table 2 marks HIGH CONFLICT obligations as irreconcilable and directs their active management through the Domain VI Conflict Registry.Source: Table 2 · p. 64

Threat-model overlay

• The state-actor overlay requires enhanced security for PAM-adjacent identities because Silk Typhoon targeted PAM-provider credentials.Source: §6.8 · p. 66
• It requires inventorying every machine credential’s API keys and assessing foreign exposure.Source: §6.8 · p. 66
• Supply-chain reviews must assess foreign provenance and state-actor risk in AI model and component procurement beyond standard vendor-risk management.Source: §6.8 · p. 66
• Organizations under Chinese CSL jurisdiction require cross-jurisdictional data-access governance and conflict-registry entries for extraterritorial access provisions effective January 1, 2026.Source: §6.8 · p. 66

Integrated response

• The six MIGT domains map directly onto the five structural gaps identified in Section 1.2.Source: §6.9 · p. 66
• Domain I’s AI Identity Registry and lifecycle processes address the Identity Continuum by governing identities regardless of their position on the human–machine spectrum.Source: §6.9 · p. 66
• Domain III’s just-in-time provisioning and policy decision architecture are part of the framework’s mapped response to the structural gaps.Source: §6.9 · p. 66

7. Implementation Guidance: Translating the MIGT into Enterprise Programs

• The implementation roadmap is a practitioner-grounded starting framework, but it has not been tested through prospective longitudinal implementation studies.Future studies should validate, refine, and extend the four-phase roadmap.Source: §7 · p. 66

7.1 Pre-Implementation: The Current State Assessment

• The current-state assessment inventories AI identities, effective access, ownership, credential hygiene, and applicable regulatory frameworks before measuring risk reduction.Its output is a Current State Report establishing the baseline for program progress.Source: §7.1 · p. 67

7.2 Phase 1: Foundation (Months 1–6)

• Phase 1 establishes foundational AI identity governance through a registry, human ownership assignment, critical credential remediation, and an authorized provisioning gate preventing future shadow AI accumulation.Tier 1 remediation prioritizes hardcoded secrets, PAM-adjacent credentials, administrative-scope credentials, and credentials lacking rotation history exceeding 12 months.Source: §7.2 · pp. 67–68

7.3 Phase 2: Hardening (Months 6–12)

• Phase 2 replaces static credentials with cryptographic workload identity, ephemeral credentials, just-in-time access, behavioral baselines, and EU AI Act and China CSL documentation.SPIFFE/SPIRE deployment begins with the highest-risk identities, while JIT access is scoped to tasks and revoked after completion.Source: §7.3 · pp. 68–69

7.4 Phase 3: Integration (Months 12–24)

• Phase 3 targets cryptographic identity for over 95% of AI identities, zero Tier 1 static credentials, tamper-evident auditing, complete AIBOMs, and a populated conflict registry.The phase also adds supply-chain governance and automated AI-specific access certification.Source: §7.4 · pp. 69–70

7.5 Phase 4: Optimization (Month 24+)

• Phase 4 advances governance from human-speed reactive management to machine-speed proactive operation through automated policy decisions, threat-intelligence integration, autonomy progression, and regulatory monitoring.Human review remains triggered for high-risk deviations and state-actor indicators.Source: §7.5 · p. 70

7.6 Implementation Guidance for Specific Organizational Contexts

• Organizations with identity debt should triage PAM-adjacent, administrative, and externally exposed credentials early, while globally regulated organizations should start conflict mapping during assessment.EU-exposed organizations must schedule around the August 2026 EU AI Act enforcement date.Source: §7.6 · pp. 70–71

7.7 Measuring Program Effectiveness

• Program effectiveness is measured through coverage, credential hygiene, behavioral monitoring, accountability, and regulatory-compliance metrics.Targets include zero active Tier 1 static credentials and zero AI identities without designated owners.Source: §7.7 · p. 71

8.1 Restating the Four Claims

• The paper identifies four claims: AI identity risk needs its own taxonomy; three governance gaps require simultaneous treatment; foreign actors already exploit AI identity; and jurisdictional fragmentation is itself a risk.The MIGT addresses the three gaps simultaneously, while AIRT enumerates 37 risk sub-categories across eight domains.Source: §8.1 · pp. 72–73
• 144 to 1 machine-to-human identities, fewer than half covered by governance capabilities, and ungoverned permissions rising from 5% to 28% demonstrate the scale of the deficit.The CrowdStrike outage, tj-actions compromise, and Typhoon campaigns are presented as evidence of harm at national scale.Source: §8.1 · p. 72
• Silk Typhoon, Salt Typhoon, Volt Typhoon, and North Korean AI-enhanced identity fraud establish foreign-state exploitation of AI identity governance gaps as a present operational reality.The cited evidence includes compromise of nine major U.S. telecommunications providers and PAM-provider credential targeting.Source: §8.1 · pp. 72–73
• The regulatory alignment domain and matrix are presented as an enterprise-level response to five frameworks and three structural fault lines producing irreconcilable cross-jurisdictional conflicts.Organizations must satisfy independently developed frameworks without an international coordination mechanism.Source: §8.1 · p. 73

8.2 The Inflection Point

• The inflection point combines machine-speed identities and agentic risk with a narrowing governance window, while production-ready standards, standardization efforts, and regulatory pressure make action achievable.Keyfactor reports that 85% expect agent identities to become as common as human and machine identities within five years, and 86% say unique dynamic identities are required for trust.Source: §8.2 · p. 73

8.3 Limitations

• The paper’s limitations include unvalidated AIRT severity ratings, an implementation roadmap not tested longitudinally, analysis limited mainly to three jurisdictions, and a taxonomy current only as of March 2026.The authors call for incident-data validation, implementation studies, and extension to additional jurisdictions and emerging attack techniques.Source: §8.3 · p. 74

8.4 Future Research Directions

• Future research targets empirical taxonomy validation, longitudinal MIGT studies, MCP-specific governance, international conflict-resolution mechanisms, OT and consumer-AI extensions, and cross-border accountability attribution.The paper highlights unresolved accountability when foreign actors exploit machine credentials across borders.Source: §8.4 · pp. 74–75

8.5 A Closing Observation

• 81% of technical teams have moved AI agents into testing or production, yet only 14.4% report full security and IT approval, leaving most deployments without adequate governance review.The MIGT supplies a structured foundation rather than solving the operational problem itself; execution still requires investment and sustained commitment.Source: §8.5 · p. 75