AI agents have long been working productively: They triage support tickets, answer employee questions using internal knowledge sources, process invoices, review transactions for fraud detection, and open pull requests in their own repository. In doing so, they access core systems - with the permissions of their users or, worse, with far greater permissions. This is precisely where a blind spot arises: Who is the identity behind the agent? What permissions apply when it acts on behalf of a human? And how do you demonstrate this to auditors, the EU AI Act, NIS2, and DORA? This presentation highlights the practical pitfalls of IAM - overprivileged service accounts, prompt injection, and a lack of traceability - and the resulting regulatory obligations. The focus is on “on-behalf-of” flows, ...