The question nobody budgets for
When a Canadian insurer gives an AI agent read access to a claims database, the access review usually asks one question: can this agent see what it's supposed to see? It rarely asks the question that matters more six months later: when this agent's scope quietly expands — a new system connection here, a new permission there, each one reasonable on its own — who is accountable for what it did, and can anyone prove it after the fact?
That second question is an identity question, not an access question, and Canadian organizations are mostly unprepared to answer it. The Canadian Centre for Cyber Security's guidance on agentic AI is blunt about why this matters now rather than later: agentic systems are taking on a growing operational role, which means the window for building identity discipline in before deployment, rather than retrofitting it after an incident, is closing. The Cyber Centre's position is not that agentic AI is unsafe to adopt — it explicitly notes agentic AI can automate repetitive, well-defined, low-risk tasks effectively. The caution is narrower and sharper: the same expanded capability that makes agents useful is what makes misuse, misappropriation, or simple configuration drift capable of producing privacy breaches, service disruption, or security incidents that look nothing like the narrow pilot that got approved.
How an agent's identity disappears by default
Here is the mechanical problem underneath the governance language. Most AI agents deployed inside Canadian organizations today don't have an identity of their own. They inherit one — a developer's API key, a service account built for something else, a human employee's session token borrowed because it was already there and it worked. That borrowed identity is the root of almost every downstream accountability failure, because it means the agent's actions are indistinguishable from the human's actions in every log, every audit trail, and every incident review.
Picture how this plays out inside a mid-sized Canadian organization that has, like most, deployed an agent incrementally rather than through a single formal rollout. The agent starts narrow: summarize claims files, flag items for human review. Someone — reasonably, under deadline pressure — extends it to check a second system before escalating. Nobody revisits the original access grant because nothing broke. Six months in, the agent touches three systems under a credential that was scoped for one. If something goes wrong now — a wrong record accessed, a payment flagged incorrectly, a customer's data exposed to the wrong internal process — the incident review has no way to isolate what the agent did from what a human did using the same credential, because they share one. This is illustrative, not a reported incident, but it describes the exact gap the Cyber Centre's guidance and the Treasury Board's agentic AI framework are both written to close: identity has to be assigned deliberately, because it will not emerge on its own from a system built around human logins.
What accountability actually requires
The accountability literature on this point is consistent even across very different institutional contexts. The NTIA's framework for AI accountability states the underlying principle plainly: to be accountable, the people and organizations deploying an AI system have to be able to assure others that the system is trustworthy, and to face real consequences when it isn't. That's not achievable retroactively. You cannot reconstruct what an agent was authorized to do, what it actually did, and who approved the gap between the two, if the agent never had a distinct identity to log actions against in the first place.
This is why the accountability conversation and the identity conversation are really one conversation wearing two names. Clear lines of responsibility — who created the system, who deployed it, who is answerable for its outcomes — are only enforceable if the system itself produces a trail that maps cleanly onto those lines. An agent acting under a shared or borrowed credential breaks that mapping by design, regardless of how well-intentioned the governance policy sitting on a shelf nearby happens to be.
Canada's federal government has been explicit that this is infrastructure, not aspiration. The Government of Canada's guide on the use of agentic AI distinguishes agentic systems from generative ones precisely on this basis: agentic AI doesn't just produce outputs in response to a prompt, it carries out tasks, sequences steps, and interacts with other digital systems to pursue goals within boundaries someone has to define and maintain. Boundaries that aren't tied to an enforceable identity are not boundaries. They're documentation.
The six-month problem
There's a specific regulatory detail worth sitting with here because it exposes how thin most organizations' current practice actually is. Logging and monitoring requirements under emerging AI accountability rules call for retaining event logs for a minimum of six months — enough to reconstruct what happened if something goes wrong and someone asks. That requirement assumes the logs are meaningful in the first place: that an entry reading "agent accessed payments system" can be tied to a specific, scoped, revocable identity rather than a shared credential that also authorizes a dozen unrelated human actions. Six months of logs built on a shared identity don't produce accountability. They produce six months of ambiguity, carefully dated.
This is also where the oversight literature draws its sharpest line. Academic work on AI accountability argues that high-risk systems need human-in-the-loop oversight specifically because automated decision-making at scale outpaces an organization's ability to catch errors after the fact. Human-in-the-loop oversight is meaningless, though, if the "loop" can't tell which actions were the agent's to begin with. Identity is the precondition for oversight, not a parallel requirement alongside it.
The honest counterargument
The strongest objection to formal agent identity isn't philosophical, it's operational: provisioning distinct, scoped, auditable identities for every agent, service account, and workflow adds real friction to deployments that are being sold, and often funded, on the promise of speed. A security team that insists on identity scaffolding before an agent goes live will move slower than a competitor that skips it. That tradeoff is real and shouldn't be waved away with reassurances that governance "actually speeds things up" — sometimes it does, often it just costs more upfront and pays off later, if the organization is still paying attention later.
But the comparison isn't speed versus caution in the abstract. It's speed now versus the cost of an unattributable incident later, in a regulatory environment where Canada's new AI strategy has named public trust and transparency as central commitments, not side considerations. An organization that can't produce a clean account of what its agent did, when, and under whose authorization isn't just exposed to a security incident. It's exposed to a credibility problem with regulators and customers at exactly the moment it most needs to demonstrate control.
What a defensible position looks like
None of this requires treating every agent like a human employee with a full HR file. It requires treating each one as a distinct, nameable thing with its own credentials, its own scope, its own logs, and one person who can answer for it. In practice: a current inventory of what each agent can actually reach, not what it was approved to reach at launch; an owner assigned by name, not by team; access, authentication, and revocation documented well enough to survive an audit; and procurement decisions that weigh an agent's identity and auditability as seriously as its price.
The organizations that get this right won't be the ones with the most sophisticated AI. They'll be the ones that can answer, without hesitation, a question regulators and customers are increasingly entitled to ask: when your agent acted, how do you know it was authorized, and how do you prove it wasn't someone else wearing its credentials? Most Canadian organizations deploying agentic AI right now cannot answer that question yet. The gap between deploying an agent and being able to answer for it is where the next wave of incidents will come from — not because the technology failed, but because nobody gave it an identity of its own.