From Identity Governance to Intent Governance
Capgemini ·
The decisive question is no longer only “who has access?”, it is “why may this agent act, under which approved intent, and how can it be stopped?” The post From Identity Governance to Intent Governance appeared first on Capgemini .
The decisive question is no longer only “who has access?”, it is “why may this agent act, under which approved intent, and how can it be stopped?”
AI agents are changing the identity and access management (IAM) landscape. Traditional identity governance was built around people, service accounts, and relatively predictable access patterns. Agentic AI introduces different levels of complexity: an agent can interpret an objective, call tools, select alternative execution paths, collaborate with other agents, delegate work, and even create child-agents.
Registering an agent as a non-human identity is essential, but it does not, on its own, govern why the agent exists or whether its actions continue to serve the approved business purpose.
Intent governance addresses this gap by establishing a governed, machine-readable representation of an agent’s business mission. Intent combines purpose and expected outcomes with technical objectives, permitted capabilities, risk boundaries, legal and ethical constraints, human ownership, delegation rules and evidence requirements. Intent is more than free-text metadata or another role attribute. It provides the foundation from which enforceable policies can be derived and against which an agent’s actions can be evaluated.
That creates a traceable governance chain: Agent → Intent → Policy → Context → Decision → Enforcement → Evidence → Containment. The chain connects a business- defined purpose to runtime authorization and, ultimately, accountability. It helps organizations establish not just what an agent can access, but what it is authorized to do, under which conditions, and within what boundaries.
The practical implication: Authorization must extend beyond login-time access. For sensitive actions, authority should be evaluated at each relevant tool call or execution step. The agent’s actions and intended outcomes must be checked against the original approved objective to ensure that its behavior remains within authorized boundaries.
Conventional policy architecture uses a Policy Administration Point (PAP), Policy Information Point (PIP), Policy Decision Point (PDP), and Policy Enforcement Point (PEP). Agentic systems require additional safeguards. A Policy Consistency Engine checks whether derived policies remain within the root intent. Deterministic conflict resolution handles competing policies. Independent supervisor agents monitor drift, bypass, abnormal delegation, and suspicious collaboration. An evidence and containment plane preserves records and isolates the ecosystem when preventive controls fail.
The PIP should govern authoritative source, freshness, retrieval order, cache permission, and failure posture. The PDP can then refuse stale or inferred context when a fresh source read is required.
PEPs should intercept critical actions at MCP or API gateways, service meshes, runtimes, workflows, and infrastructure boundaries. A control that depends on agent cooperation is not an independent control.
Root intents and derived policies should be hashed, signed, versioned, and attested at runtime. A valid signature proves provenance and integrity, not that a policy is lawful, ethical, or logically correct.
Supervisor agents can provide an additional layer of behavioral assurance by comparing observed actions and outcomes with the approved intent. They should operate with separate identities, bounded authority, and independent monitoring. They must complement, not replace, deterministic cryptographic checks or become the sole authority for containment,
Delegation requires some discipline. A child-agent should be created only when its assigned intent remains within approved boundaries for capabilities, duration, risk, and delegation depth. Each child should retain provenance to its parent, root intent, policy version, authorization decision, and named human owner.
A child-agent does not necessarily inherit the parent agent’s authorizations. Instead, it is allowed to receive its own ‘least-privileged’ authority set, derived from the delegated task, and constrained by the approved intent and additional relevant risk attributes.
The supervision agent will be faster in reaching the decision point of the running agents since it takes less processing time to check than a running agent needs to get to the same decision point.
Effective containment may require multiple coordinated actions: revoking identities, tokens and secrets, blocking agent and tool traffic, pausing runtimes and schedulers, quarantining network routes, restricting sensitive data access, stopping compute, and preserving evidence externally. The real resilience test is whether an organization can isolate an individual agent, its delegation tree, an intent family, or the full platform without agent cooperation.
Organizations can begin strengthening governance for AI agents through a set of practical steps:
These steps provide a foundation for evolving identity governance to address the distinct risks of autonomous and increasingly interconnected AI systems.
Creating and maintaining consistent policies across business, application, and infrastructure layers is a significant governance challenge. Policies must remain traceable to the approved root intent while avoiding contradictions, gaps, and unintended authorization paths. Identity Governance and Administration (IGA) platforms provide an important foundation for addressing this challenge.
For example, SailPoint Agentic Fabric brings together identity context, behavioral monitoring, policy evaluation, and contextual enforcement to help organizations govern AI agents and non-human identities. Capabilities such as agent lineage and ownership mapping, least-privilege access, policy-driven containment, and audit evidence can support the broader goal of aligning agent behavior with authorized business intent.
The effectiveness of such capabilities depends on how they are integrated with the wider governance architecture, including independent policy enforcement, trusted context, delegation controls, and containment mechanisms.
The supervising agent can additionally check if the agent’s actions are in line with the original prompts. This matching of the initial intent as captured in the original prompt with the final action being taken by the agent on the target system ensures that the agent is not deviating from that starting point of intent.
Aligning with NIST guidance
The Intent Governance model operationalizes themes from the NIST AI Risk Management Framework, the Generative AI Profile, Zero Trust Architecture, and NIST work on agent identity and authorization.
These frameworks and publications provide useful foundations for managing AI risk, access, and trust. However, the specific intent governance model described here, including its extended control-plane components and governance chain, is an implementation approach rather than an architecture prescribed by NIST.
From identity to intent
Source: “From Identity Governance to Intent Governance”, draft v2.0. NIST mapping is an implementation interpretation, not a claim that NIST prescribes architecture. As organizations introduce AI agents into business-critical processes, identity governance must evolve to address not only access rights but also purpose, delegated authority, and runtime behavior. Establishing this connection is essential to enabling autonomous action while maintaining accountability and control.
At Capgemini, our IGA services help organizations strengthen identity governance across people, applications, and non-human identities. As AI agents become more autonomous, this foundation can evolve to connect identity, intent, policy enforcement, and continuous oversight, helping organizations adopt agentic AI with greater confidence.
The post From Identity Governance to Intent Governance appeared first on Capgemini .