When a recent analysis claimed that a 30,000-employee AI agent rollout would require 1.3 million identities, the number seemed staggering. But beneath the surface of this headline figure lies a fundamental misattribution: the 45x multiplier is not a product of agent deployment; it is the existing, largely unmanaged stock of non-human identities (NHIs) that enterprises have accumulated over years. The real story isn't about new debt—it's about discovering a debt that was never accounted for.
The original article, published by a prominent industry consortium, argued that scaling AI agents across a workforce would multiply identity requirements by 45 times, citing a Fortune 500 case with 4.2 million NHIs against 50,000 human accounts (an 84:1 ratio). Yet that same case disclosed no agent deployment at all. The high ratio is a property of the environment—legacy service accounts, API keys, database credentials, and machine certificates—not a consequence of agent adoption. Using 45x to multiply seats simply re-labels pre-existing liabilities as a new "agent bill." This is the kind of accounting sleight-of-hand that, in my audit experience, often precedes a budget shock.
The technical distinction matters. Service accounts are long-lived static keys. Agent identities, by contrast, should be short-lived, delegatable (on-behalf-of), and action-authorized—think OAuth 2.1 Token Exchange, SPIFFE-SPIRE SVIDs, or Vault dynamic secrets. The article warns that 47% of NHIs have not been rotated in over a year, but that statistic actually proves the opposite of its intended point: those are legacy static debts. Agents should not inherit them, nor should they be governed like them. Conflating the two pushes buyers toward the wrong remedy—issuing service accounts to agents—which merely replicates the same failure mode at a larger scale. Tracing the hidden vulnerabilities in the code reveals that the real risk is not identity count, but the lifecycle and scope of each credential.
And the arithmetic of human review is already dead. If 1.35 million identities are divided across 250 workdays, that's 5,400 identities per day. An eight-hour shift leaves 5.33 seconds per identity—with zero breaks, zero context switching, and zero remediation time. Any control that relies on per-identity manual review (traditional IGA access reviews, SOX quarterly attestations) is mathematically infeasible at this scale. The only viable path is policy-as-code combined with attestation-based authorization and automatic expiry via short TTLs. This is the most valuable inference the original article fails to make, and it has direct implications for blockchain-based identity systems: if you cannot automate governance, you cannot secure a fleet.
The real technical risk in multi-agent workflows is not the number of identities but the traceability of the authorization chain. The article mentions "temporary identities with lifespans measured in seconds," but it misses the engineering difficulty: in a delegation chain (user → orchestrator → sub-agent → tool), each hop must converge permissions and maintain auditable lineage. Second-level identities without per-action authorization and lineage records create millions of orphaned audit trails. Redefining what ownership means in the digital age requires us to treat every delegated action as a first-class governance event.
This brings us to the commercial heart of the matter: a pricing unit war. Seats are billable per head; identity fleets are not. If buyers start negotiating on "a multiplier behind every seat," the denominator of the entire agent business model changes, and vendor margins get recalculated. NHI security platforms typically price at $3–15 per identity per year, so 1.35 million identities translate to $4.0M–$20.3M annually—often one to three times an entire IAM team's budget. This isn't a deployment cost; it's a new budget line item. The buyer's willingness to pay is already visible: 96% of executives claim confidence in NHI IAM, but only 34% apply the same controls to digital labor, and 58% have had an incident in the past year. That 62-point confidence-control gap is a direct measure of pain—companies are already paying for not buying.
Open-source alternatives lower the ceiling. SPIFFE/SPIRE (CNCF), HashiCorp Vault dynamic secrets, and the OpenBao ecosystem can cover a significant portion of short-lived machine identity needs at zero license cost. Commercial differentiation must therefore shift to discovery and ownership—inventory, ownership graphs, and offboarding automation—not issuance itself. The article's repeated emphasis on "nobody claims them" is, in effect, a demand primer for exactly that differentiator.
The competitive landscape is a self-created demand track: the fear data is produced by the very vendors selling solutions. The CSA whitepaper cites Entro Security (an NHI security vendor); the Okta survey is sponsored by Okta, which is pushing its own Agent ID line. The demand direction is credible, but effect sizes are systematically inflated. My own estimate, based on audit work across non-cloud-native enterprises, is that the real NHI:human ratio is closer to 8–20x, not 45x. Quietly securing the layers beneath the hype means discounting the sales pitch and focusing on the actual attack surface.
That attack surface is best measured not by count but by a risk integral: Risk ≈ Σᵢ ∫ (privilegeᵢ × reachabilityᵢ) dt. Four million agent identities with 15-minute TTLs and single scopes may be safer than 50,000 human accounts with persistent admin rights and no MFA. Reducing identity count—by merging scopes or reusing credentials—actually increases per-identity privilege and is a negative optimization. The 47% static-credential statistic points to legacy debt, not agent risk. The real explosion radius comes from delegation-chain depth: a depth-4 chain without permission convergence equals a four-way privilege union. And the operational reality is sobering: 30,000 seats generating 20 agent actions per day yields 600,000 actions, each with at least three identity events (issuance, authorization decision, resource access)—about 1.8 million events per day, or several gigabytes of pure identity logs. Manual per-event review is impossible; SIEM licensing costs will rise; forensic windows and retention policies must be redesigned. The original article never touches this layer.
For blockchain identity solutions, the lesson is clear: issuance is already a commodity. The sustainable moat lies in cross-cloud, cross-SaaS ownership graphs and offboarding automation—the unglamorous work of discovery. The investment case is not "AI agents are hot, so identity matters," but rather "compliance audits have made NHI a finding item." Spending is driven by audit obligations (SOX ITGC, FFIEC, NYDFS Part 500), not by security team persuasion. That certainty is an order of magnitude higher. The risk is not demand failure; it is platform bundling—Okta, Microsoft, and CyberArk are already integrating agent identity into their suites, and independent NHI vendors will likely be acquired or squeezed within 18–36 months.
Building trust through rigorous, unseen diligence means acknowledging that the identity governance market is shifting from audit-driven to runtime policy-driven. Manual access reviews will be formally abandoned at this scale. Blockchain projects that promise decentralized identity must avoid repeating the static-credential debt of the past. The opportunity is not in minting new DIDs, but in automating the discovery, delegation, and expiry of every non-human identity. Will the industry finally solve the problem it has promised to solve for a decade—or will it merely replicate the same fragile architecture under a new name?