Federal Modernization Workbook · Book 17
Book 17 — AI Identity Governance
Every AI System Needs an Identity and an Owner
Why AI agents need identities and owners: what federal AI rules require and don’t, the use-case inventory as an identity source, the kinds of AI identity, owners and lifecycle, credentials and least privilege, monitoring and shadow AI, who owns AI identity, the inventory scan, and evidence for authorization
This book is part of Release 2.0, the workbook’s baseline edition: it is complete, checked against every other book and approved by the workbook’s editor, and later changes are tracked against Release 2.0. Baseline is not a claim of independent peer review (Status labels). This book replaces the workbook’s AI identity governance operational guide (its overview, the governed path and the central deployment model) and the federal AI governance readiness brief. Every external claim was checked against a primary source between October 21 and November 2, 2026 and carries a note. Federal AI policy and the identity platforms for AI agents are both moving quickly; the release stage and government-cloud availability of each feature are stated as of those dates. The replaced pages are kept in the repository’s archive/b17-ai-identity/ folder, and their old addresses forward to the chapters that replaced them.
b17-ai-identity-bundle.docx: the whole book as one Word document, regenerated on every site deploy.
15-minute presentation (about 13 minutes narrated): the Why / What / Who / How deck is on the Presentations page.
Executive briefing (about 30 minutes live, 15 narrated): for the CIO, CISO, Chief AI Officer, authorizing officials: why AI agents need identities, what federal AI rules require, ownership and lifecycle, shadow AI and the decisions to make, on the Presentations page.
Technical deep dive (about 50 minutes live, 21 narrated): AI agents as identities and the federal rules, the inventory and the kinds of AI identity, owners, credentials and least privilege, and monitoring, shadow AI, the scan and the evidence, in modules on the Presentations page.
AI systems sign in. They hold tokens, call APIs, read records and, increasingly, act: an agent can open a ticket, change a setting or send a message on its own. To the directory each one is an identity, but most were deployed outside the identity program, with no owner of record, no organizational placement, no credential lifecycle and no leaver process. The federal AI use-case inventory lists these systems and reports whether each has an authorization and the required risk practices in place, but it has no fields for who owns the identity, what credential it uses or what it can reach. Book 17 treats AI governance as, in large part, identity governance applied to a new kind of principal. It sets out what federal AI rules require and what they don’t: there is no AI-specific authorization to operate, and AI systems go through the agency’s existing process. It then reads the inventory as an identity source, sorts AI access by whose token a system presents, and gives every AI identity an accountable human sponsor, credentials without stored secrets, least-privilege access, monitoring and drift findings, and a lifecycle that ends. It closes with the inventory scan, run by an agency or centrally, and the evidence an authorizing official needs for an AI system.
Which track this book covers
The workbook moves an AD forest to Entra ID on four tracks, and AI agents belong to the non-person identity track, alongside the service accounts and workload identities in Book 02, Chapter 09. An agent has no HR record. Its accountability is its sponsor and owner (Chapter 05). Its lifecycle hangs from the sponsor’s HR-driven lifecycle and from its inventory record, and it ends by expiry or retirement (Chapter 05). Its credentials carry no stored secrets (Chapter 06). As the program’s design, this supports AC-2, IA-4, IA-5 and IA-9 for AI identities (Appendix A).
Why, what, who, how
| Question | Chapters | |
|---|---|---|
| Why | Why do AI agents need identities and owners, and what do federal AI rules require, and not require? | 01, 02 |
| What | The inventory as an identity source, the kinds of AI identity, owners and lifecycle, credentials and least privilege, and monitoring, drift and shadow AI | 03, 04, 05, 06, 07 |
| Who | Who owns AI identity governance, from the Chief AI Officer to the agent’s sponsor | 08 |
| How | Run the inventory scan, for one agency or centrally, and evidence AI systems for authorization | 09, 10 |
Appendix: A — Requirements mapping: AI rules to identity controls
Reading paths
- Executives, Chief AI Officers and CIOs (20 minutes): Chapters 01, 02 and 08, or the 15-minute presentation.
- Identity and access teams: Chapters 04, 05 and 06.
- Security operations: Chapter 07.
- AI governance and inventory leads: Chapters 03 and 09.
- ISSOs, assessors and authorizing officials: Chapters 02 and 10, with Appendix A.
Where this book sits in the workbook
This is Book 17 of the Federal Modernization Workbook. Book 18, Application Modernization, applies this book to AI built into modernized applications. Workload identities and the Entra target are in Book 02, Chapter 09; the human joiner, mover and leaver lifecycle in Book 03; Conditional Access, application consent and workload identities in Book 04; the evidence contract and identity telemetry in Book 12; the drift model in Book 13; authorization and continuous monitoring in Book 14; SaaS and OAuth integration governance in Book 15, Chapter 06; and the workforce training program in Book 16. The M-25-21 practice of training the operators of high-impact AI, and how this book ties it to the operators’ accounts, is in Chapter 03.
Phase 6 of the Non-Person Identity Modernization plan schedules this book.
New and revised procedures in this book follow the workbook’s implementation conventions (control states, the How-section template, authority labels, the evidence checklist, change safety and the Zero Trust mapping block), defined once in Book 00, Appendix D.
Chapters
| Title | Description |
|---|---|
| Chapter 01 — Why AI Agents Need Identities and Owners | Why an AI system that can act, not just answer, is an identity like any other: it signs in, holds permissions and touches agency records; how most AI arrived outside the identity program, with no owner of record, no organizational placement, no credential lifecycle and no leaver process; why the risk it carries is identity-shaped; why the existing control catalog already covers it; and the seven things every AI identity needs, which the rest of the book builds. |
| Chapter 02 — What Federal AI Rules Require, and What They Don’t | The federal AI rule set in force in October 2026: what OMB M-25-21 requires of agencies (the Chief AI Officer, the annual inventory, compliance plans and the seven minimum practices for high-impact AI) and what it rescinded; M-25-22 on acquisition; M-26-04 and the unbiased AI principles; the 2026 executive orders on AI security and on terminology; the NIST AI RMF, the Generative AI Profile and the planned SP 800-53 overlays; CISA and FedRAMP; why there is no AI-specific authorization to operate; and how the rules read as identity obligations. |
| Chapter 03 — The AI Use-Case Inventory as an Identity Source | What the Federal AI Use Case Inventory records under OMB’s 2025 guidance and how many use cases it holds; which of its fields can anchor an identity record and which identity facts it doesn’t record; why a use case isn’t an identity; how its high-impact fields report status for all seven M-25-21 minimum practices without evidencing any of them; and how the program uses the inventory as the seed list for AI identity governance. |
| Chapter 04 — Kinds of AI Identity: Workloads, Agents and Delegated Access | The ways an AI system obtains access, sorted by whose token it presents; Microsoft Entra workload identities, managed identities and workload identity federation as they apply to AI; the Microsoft Entra Agent ID object model of blueprints, agent identities and agents’ user accounts; delegated and autonomous access and what each means for policy and logs; release stage, licensing and government-cloud availability as of October 2026; a brief contrast with AWS and Google; and how the program classifies an AI estate. |
| Chapter 05 — Owners, Sponsors and the AI Identity Lifecycle | Who is accountable for an AI identity and how its lifecycle runs: the owner, sponsor and manager relationships in Microsoft Entra Agent ID, the joiner, mover and leaver events applied to AI systems and agents (creation, sponsor change, reorganization, retirement and orphaned agents), expiring access and recertification with Entra ID Governance, release stage and government-cloud availability, and the program’s design where the agent features aren’t available. |
| Chapter 06 — Credentials, Least Privilege and Access Policy for AI | How AI systems and agents authenticate without stored secrets (managed identities, workload identity federation and certificates on the agent identity blueprint), how to keep Microsoft Graph and API permissions least-privileged, how admin consent and CISA’s SCuBA consent baseline apply to agents, which Conditional Access and ID Protection policies reach workload and agent identities, why AI identities hold no standing privileged roles, and how to bound the tools and data an agent can call, with the release stage and government-cloud availability of each feature. |
| Chapter 07 — Monitoring, Drift and Shadow AI | How the program watches AI identities once they exist: the sign-in, audit and risk signals for workload and agent identities, how to find AI systems nobody declared, the drift findings that compare the declared record with what is observed, and how each finding becomes evidence under the Book 12 contract and the Book 13 drift model. |
| Chapter 08 — Who Owns AI Identity Governance | Who decides and who does the work when AI systems get identities: the Chief AI Officer’s duties under OMB M-25-21, the CIO, the CISO, the authorizing official, the official who accepts risk for an AI use case, the system owner, the agent’s sponsor and technical owner, the identity team, security operations, the privacy officer and acquisition, with a responsibility matrix consistent with the program’s other Who chapters. |
| Chapter 09 — Running the Inventory Scan, Agency and Central | How the program scans an AI use-case inventory for identity-governance gaps, step by step at agency level (load a vintage, detect, prioritize, report, remediate, compare vintages), and how the same scan could run centrally across agencies on the published inventory, with what the CDM comparison does and doesn’t support and what no central scan can close. |
| Chapter 10 — Evidence and Authorization for AI Systems | Why AI systems go through the agency’s existing authorization process rather than an AI-specific one; what evidence an authorizing official needs about an AI system’s identity (owner, credentials, permissions, monitoring, lifecycle); the high-impact practices as evidence; the annual inventory, compliance-plan and waiver cadence; carrying AI identity in OSCAL 1.2.3; and the status of NIST’s SP 800-53 overlays for AI systems. |
| Appendix A — Requirements Mapping: AI Rules to Identity Controls | A compliance-enabling map, not a compliance claim: the duties in OMB M-25-21 and M-25-22, the NIST AI Risk Management Framework functions and subcategories, and the NIST SP 800-53 Rev. 5 controls that govern an AI system’s identity, each mapped to the identity control the program uses and the Book 17 chapter that carries it, with NIST baseline and FedRAMP 2026 class membership given as separate facts; then the other federal sources the book relies on, and the requirements the source material cited that don’t say what was claimed. |
Version and revision history
Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.
| Version | Edition | Date | Changes |
|---|---|---|---|
| 2.0 | 2026.11.5 | 2026-11-08 | Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Edition 2026.11.4: record the edition and point deck links at it (#362); Book 17: fix confirmed crosswalk errors (#383); Apply the open-choice decisions: text, plans, training, reference, register (#416); Figures, kit and config: Entra Domain Services diagram, CLM figure, Book 17 figures, hcm-entra slots 4-6, NPI apply hash and operator (#418); External Partner Person: light edits to existing pages, held findings, links (E0 to E9) (#419); Book 17: align inconsistent terms, owners, dates and licenses (17 findings) (#438); Decisions fix pass for Books 13 to 19: Book 18 gates and roles, Db2 spelling, Book 15 approvers, Book 16 criteria, Book 17 roles, Book 13 drift mapping (#456); and 4 more (all changes) |
| 1.5 | 2026.11.4 | 2026-11-05 | Approve ten pages on Mike’s word, and drop two names from the briefs (#360); Sweep stale wording, and link sources on every deck (#361) |
| 1.4 | 2026.11.3 | 2026-11-05 | Book decks: narration names the book or the original source, and 68 videos re-exported (#344) |
| 1.3 | 2026.11.2 | 2026-11-02 | Privacy for workforce identity: Book 03 Chapter 14, and privacy sections in six books (#317) |
| 1.2 | 2026.11.1 | 2026-11-01 | Edition 2026.11: record the edition, and publish the four gate-level decks and videos (#282) |
| 1.1 | 2026.11 | 2026-11-01 | Move the decks and narration audio out of git, onto edition 2026.10 (#260) |
| 1.0 | 2026.10 | 2026-10-31 | First edition (17 merged changes since the book began) |