What is AI agent identity?

AI agent identity is the practice of giving an autonomous AI agent its own identity in your systems — separate from any human — so you can authenticate it, decide what it's allowed to do, and audit what it did. Today most agents borrow a person's login or share a generic service account, which means their actions are indistinguishable from a human's in the logs and impossible to revoke in isolation. Agent identity gives each agent its own credential, its own scope, and its own audit trail.

Why are investors funding AI agent identity startups in 2026?

Because enterprises deployed autonomous agents faster than they wrote down what those agents are allowed to touch, and that gap is now visible at scale. In two days in June 2026, NewCore came out of stealth with $66 million to rebuild workforce identity for agents, Arcade raised a $60 million Series A for an agent authorization layer, and Ping Identity and AppViewX both shipped agent-identity products. Arcade alone says tool-call volume rose 25x in six months. The money is the industry pricing in a problem operators already had: millions of automated actors with access nobody scoped.

Do AI agents need their own identity separate from human users?

Yes, if you want to control or audit them. An agent running on a borrowed human credential inherits that human's full access, can't be revoked without locking the person out, and leaves no separable trail of what it did versus what the person did. Giving the agent its own identity lets you scope it to the minimum it needs, shut it off independently, and answer the question 'which agent did this, on behalf of whom, against what' — which is exactly the audit trail the new platforms are built to produce.

Does buying an agent identity platform solve AI agent access control?

No — it enforces a decision you still have to make. An identity or authorization platform stores, applies, and audits the rules about what each agent can touch. It does not decide those rules. Someone inside the company still has to sit down and define, per agent and per system, the least access it needs to do its job. That scoping work is process work, not a product. The platform is the lock; you still have to decide who gets a key.

What's the difference between authenticating an AI agent and authorizing it?

Authentication answers 'is this really agent X?' Authorization answers 'is agent X allowed to do this specific thing?' NewCore's pitch is mostly the first — give agents real, revocable identities. Arcade's is mostly the second — a layer that decides, per action, whether the agent may proceed. Both matter, and both enforce decisions a human has to make first. Knowing it's agent X tells you nothing about whether agent X should be able to issue a $5,000 refund.

AI agent identity is the access contract your org never wrote

In 48 hours this week, AI agent identity went from a niche security concern to the most-funded idea in enterprise software. On June 15, NewCore came out of stealth with $66 million to rebuild workforce identity for a world of AI agents. The same day, Arcade raised a $60 million Series A to be the authorization layer that decides which actions an agent is allowed to take. The next morning, Ping Identity and AppViewX each shipped agent-identity products. Four moves, two days, one bet: that the enterprise just hired millions of automated workers it never issued a badge to.

Here’s the part the funding rounds don’t say out loud. Identity software doesn’t write your access contract. It enforces one — and most companies never wrote it.

TL;DR: A wave of money landed on AI agent identity in mid-June 2026 — NewCore’s $66M, Arcade’s $60M Series A, new agent-identity products from Ping Identity and AppViewX, all inside two days. The market is real because the gap is real: enterprises deployed autonomous agents before anyone scoped what each one is allowed to touch. But identity and authorization platforms enforce, store, and audit an access contract. They don’t author it. That decision — what each agent may do, in which system, with whose data — is process work that has to happen inside the company first. Every agent you’ve shipped is a service account nobody scoped.

The week identity repriced around agents

This isn’t a trend piece stitched together from think-tank quotes. Four specific, dated events landed in 48 hours.

Move	Date	What they’re selling
NewCore — out of stealth, $66M (Cyberstarts, Index Ventures, Evolution Equity)	June 15, 2026	Identity rebuilt so AI agents are “first-class identities” with their own lifecycle and trust scoring
Arcade — $60M Series A ($72M total)	June 15, 2026	An authorization layer that records “which agent, on behalf of which user, against which resource”
Ping Identity — Runtime Identity for agents across AWS, Google Cloud, Cloudflare	June 16, 2026	Authorizing, enforcing policy on, and monitoring agent actions where they run
AppViewX — Agent Identity Security	June 16, 2026	Discovering, governing, and monitoring every agent identity in the environment

Four companies, two days, one job description. NewCore’s CEO put the premise plainly in the launch announcement: “Identity is broken, and yet it has become the control plane of the modern enterprise.” The company says it built for environments where agentic identities outnumber human ones “by two orders of magnitude or more.” Arcade, for its part, says tool-call volume across its platform rose 25x in six months, and that it authored the MCP authorization specification Anthropic adopted. The demand is not theoretical. The agents are already calling the APIs.

What the money is actually buying

Strip the branding and there are two distinct problems here, and it’s worth keeping them apart.

Authentication is “is this really agent X?” That’s most of NewCore’s pitch — give every agent a real, revocable identity instead of letting it run as a person. Authorization is “is agent X allowed to do this specific thing?” That’s Arcade’s — a layer that checks, per action, whether the agent may proceed, and writes down what happened.

Both are enforcement. Neither is the decision. Knowing the caller is agent X tells you nothing about whether agent X should be able to issue a refund, read the salary column, or push to the production branch. Someone has to decide that — per agent, per system, per field. The platform will then store that decision, apply it on every call, and keep the audit trail. It will not make it for you. You can buy the lock. You still have to decide who gets a key, and to what.

That decision is the access contract. It’s the same shape as the data contracts that decide whether an integration works at all: a written, owned statement of what’s allowed to move where. And like a data contract, no vendor can author it, because only the people who run the process know what “allowed” means for their business.

The number that explains the panic

Okta’s AI Agents at Work 2026 report, published in late May, has the figure that makes the funding make sense. Ninety-six percent of executives say they’re confident their identity and access management already secures non-human identities. Only 34% actually apply the same security controls to AI agents that they apply to human employees.

Confidence at 96. Controls at 34. That 62-point gap is the entire market in one line — and it’s not a model problem, it’s an ownership problem. The same survey found 92% of executives report agents already in widespread or moderate use, and 58% have had an AI-related security incident or a close call. The agents are in production. The scoping is not.

Every agent is a service account nobody scoped

Here’s what the gap looks like on the ground, because it’s rarely dramatic. An agent gets stood up to do something useful — reconcile invoices, answer a customer, file a ticket. To reach the systems it needs, it runs on a borrowed human OAuth token with a refresh scope, or a shared service account whose secret hasn’t rotated since someone pasted it into an environment variable. The token carries far more access than the task needs, because it was scoped for a person doing a dozen jobs, not an agent doing one.

In the logs, the agent’s actions and the human’s are the same line. You can’t revoke one without breaking the other. And nobody decided, on the way in, that this agent should only ever touch these three endpoints and never that fourth one — because deciding that is work, and shipping the agent was the goal. Okta found 16% of people using unapproved AI tools have handed over login credentials to do it. That’s the polite version of what’s happening everywhere.

This is the operator thesis in its newest costume. The bottleneck was never the model’s intelligence. It’s that you deployed an automated actor before anyone wrote down what each step is allowed to touch. Every agent you’ve shipped this way is a service account no one scoped — and a $66 million identity platform doesn’t change that, it just gives you somewhere to finally write the scope down. The wave of governance products is the same admission as the shadow-AI inventory that companies discover they can’t see: the dashboard arrives after the access does.

The working version: write the access contract first

The platforms are useful. They’re also the last step, not the first. The order that actually works:

Inventory the agents and what they touch. You can’t scope what you can’t see. Before any identity product helps, you need the list: every agent running against your systems, what credential it uses, and which endpoints and tables it actually hits. Most teams are surprised by their own list. That discovery is the project; the tooling comes after.

Write the scope, per agent, per system. For each agent, decide the least access it needs and the data it’s allowed to read or change — and decide which system wins when two disagree about what a record means. That’s the access contract: a written, owned statement, not a setting buried in a console. This is the process work I do before anything gets connected, and it’s the part no vendor can do for you, because it requires knowing your business, not their product.

Then buy the enforcement. With the contract written, an identity or authorization platform is exactly the right tool — it gives each agent its own revocable credential, applies the scope on every call, and produces the audit trail that tells you which agent did what, on behalf of whom. Bought in that order, the platform enforces a real decision. Bought first, it enforces nothing, because there’s nothing to enforce yet.

The operator read

A $66 million round and an 8,000-tool authorization catalog are real infrastructure, and the teams building them are solving a problem that genuinely exists. But infrastructure enforces decisions. It doesn’t make them. The badge reader on the door doesn’t decide who works at the company — it checks a list someone else maintains. If that list is empty, a better badge reader just lets the wrong agents through faster, with a cleaner audit trail of the breach.

The companies buying agent identity this quarter and skipping the scoping are about to learn that in production. That’s the conversation worth having before the agents are already inside.