AI Agent Identity, Access and Authorization Architecture

AI agents increasingly act as digital workers that invoke APIs, access enterprise data, delegate tasks, and execute transactions across business systems. Treating agents as anonymous application processes creates unacceptable security and accountability risk because organizations cannot reliably determine who or what acted, under whose authority, with which privileges, or for what purpose. This paper proposes an AI Agent Identity, Access and Authorization Architecture based on Zero Trust, workload identity, least privilege, delegated authority, policy-based access control, short-lived credentials, transaction-level authorization, and continuous verification. The architecture distinguishes human, application, agent, sub-agent, and tool identities; defines trust boundaries and delegation chains; and establishes controls for secrets, impersonation, token exchange, tool permissions, data entitlements, approval gates, and revocation. It also addresses multiagent systems, high-risk transactions, audit evidence, emergency shutdown, and lifecycle governance. The proposed architecture enables enterprises to deploy autonomous agents with strong security, traceability, and business accountability.