Ping Identity Enterprise Personal Agent Access: Identity and Runtime Control for Claude and Other Personal Agents

On September 1, 2026, Ping Identity announced Enterprise Personal Agent Access, an end-to-end approach delivered through PingOne Privilege that combines discovery, secretless privileged access, and runtime control for personal AI agents such as Claude and Claude Code. The trigger is an uncomfortable data point: the Gravitee State of AI Agent Security report found that 48 percent of production AI agents are running unsecured. Employees and developers are already putting personal agents to work across the enterprise, approved or not, often with access to sensitive information, developer resources, and company data. Traditional identity systems were built for humans and have no idea what an agent is.

1. Personal Agents Are Bypassing the Enterprise Identity Perimeter

Human employees authenticate, pass device compliance, and request permissions before touching systems. Personal AI agents skip all of it: a marketing teammate pastes a client contract into a desktop assistant, an engineer tells Claude Code to read repositories and call internal APIs, a finance analyst connects a personal account to MCP servers. The Gravitee finding that 48 percent of production agents run unsecured is the quantified version of this reality. Ping's approach starts by discovering those agents, including shadow AI that was never approved, then binds every session to the human and device behind it. An agent is not an anonymous actor; it is an extension of a person.

# Discover personal agents running in your environment, including
# shadow AI that was never formally approved. Visibility first.
GET /pingone/privilege/agents/v1/discover?scope=enterprise
{
  "agents": [
    {
      "agent_id": "agt_claude_desktop_7f21",
      "type": "desktop_assistant",
      "product": "claude",
      "user": "u_maria@corp",
      "device": "mbp-042",
      "status": "active",
      "first_seen": "2026-08-21T09:14:00Z",
      "approved": false,
      "risk": "shadow_ai"
    },
    {
      "agent_id": "agt_codex_ci_88c2",
      "type": "coding_agent",
      "product": "claude-code",
      "user": "u_devops@corp",
      "device": "ci-runner-7",
      "status": "active",
      "first_seen": "2026-08-28T13:02:00Z",
      "approved": true,
      "risk": "managed"
    }
  ]
}

2. Four Questions Define Runtime Control

Ping CEO Andre Durand compresses the problem into one sentence: the enterprise must be able to answer whether this agent, on this device, is allowed to take this action, and whether it can prove it later. Expanded, that is four things. Discovery: which agents are running, including shadow AI. Attribution: who and which device stands behind each session. Authorization: what resources and actions each agent may access at the moment of action. Proof: whether sensitive actions require human approval, whether anomalies can be revoked in real time, and whether everything is auditable afterward. Together they make agent identity a first-class citizen as rigorously governed as human identity.

# Associate every agent session with the user and device behind it.
# An agent is not an anonymous actor; it is an extension of a human.
{
  "session": {
    "id": "sess_a1b2c3",
    "agent_id": "agt_claude_desktop_7f21",
    "user": "u_maria@corp",
    "device": "mbp-042",
    "started_at": "2026-09-01T10:00:00Z",
    "context": {
      "mcp_servers": ["internal-db-mcp", "hr-portal-mcp"],
      "repos": ["payments-core"],
      "k8s_clusters": ["staging"],
      "cloud": ["aws:dev"]
    }
  }
}

3. Why Secretless Access Is the Key Design

The biggest risk with a personal agent is not the model itself; it is the credential the agent carries. If Claude Code's configuration holds a long-lived token or API key, a prompt-injected or out-of-bounds session hands an attacker a master key. Secretless privileged access inverts that: when an agent session starts, it exchanges its identity for short-lived, scope-limited credentials bound to that session. When the agent needs a resource, the identity platform evaluates policy first and issues access only for that call. Anomalous behavior triggers real-time revocation. The result is that the agent never holds a long-term secret while doing its work, and every operation traces back to the session and the person behind it.

# Policy at the point of action: allow, deny, log, or ask a human.
# The question is not whether the agent is smart enough to act;
# it is whether the enterprise can see and control the action.
{
  "policy": "personal-agent-runtime",
  "rules": [
    {"resource": "repo:payments-core", "actions": ["read", "write"], "decision": "allow"},
    {"resource": "repo:payments-core", "actions": ["merge"], "decision": "require_human"},
    {"resource": "mcp:hr-portal", "actions": ["read_pii"], "decision": "deny"},
    {"resource": "env:prod", "actions": ["*"], "decision": "deny"},
    {"resource": "cloud:iam", "actions": ["write"], "decision": "require_human"},
    {"default": true, "decision": "log"}
  ],
  "revocation": {"on_anomaly": true, "on_risk_score_gt": 0.85}
}

4. Identity Attribution for Code That Lands

For developer workflows, this approach changes one thing immediately: every commit lands under the identity that made it, developer or agent, rather than blurring together. Agent activity is attributable to the agent itself, not just to the user. Security teams get a record of what the agent did, when it happened, and the user associated with the session. If you need to answer who asked an AI-written line to be written, you can. Engineering teams can also route agent commits through code review before merge, letting automation do the first pass before humans sign off.

5. What Personal Agents Can Reach Goes Far Beyond the Chat Window

Ping is explicit that personal AI agents can reach far beyond the AI application itself: MCP servers, code repositories, internal services and APIs, Kubernetes clusters, databases, and cloud infrastructure. A desktop assistant asked to look up an order can trigger a chain of database and internal API calls. That is why control must be enforced at the point of action: a policy layer in front of managed resources decides whether to allow, deny, log, require human approval, or revoke in real time. The security team does not need to ban AI. It needs to make sure every agent step walks a path the enterprise can see.

// Secretless privileged access: exchange the session for short-lived
// credentials bound to the agent, never a long-lived key.
async function accessTokenFor(session, resource) {
  const decision = await ping.policy.evaluate(session, resource);
  if (decision !== 'allow') {
    throw new PolicyDenied('action on ' + resource + ' -> ' + decision);
  }
  // Token is scoped, short-lived, and attributable to the session.
  return ping.privilege.issue({
    sessionId: session.id,
    resource,
    ttl: '15m',
    revokeOnAnomaly: true,
  });
}

6. What to Do Today

First, run an agent inventory: which personal agents and shadow AI are operating in your enterprise, and which systems can they reach? Second, establish identity attribution for agent sessions by binding each action to the user and device behind it. Third, replace long-lived tokens with short-lived scoped credentials and require human approval for sensitive actions. Fourth, route agent-authored commits through review, using an AI code reviewer for the first pass. Finally, do not leave this to the security team alone. Developers, platform engineers, and security need to define what agents may do together, because securing agents is really about extending identity and governance from people to machines. Concretely, start with the highest-risk pairing you can find: a coding agent that reaches production repositories, or a desktop assistant with MCP access to internal data. Pilot there for two weeks, publish what you learned, and let the policy grow from real usage instead of fear. The organizations that treat agent identity as a normal engineering problem, not a security special case, will move fastest once every vendor ships agent-native controls.

# Audit: every commit lands under the identity that made it, and
# agent activity is attributable to the agent, not just the user.
{
  "commit": "9f2c81a",
  "repo": "payments-core",
  "session": "sess_a1b2c3",
  "agent_id": "agt_claude_desktop_7f21",
  "user": "u_maria@corp",
  "actions": [
    {"ts": "2026-09-01T10:04:12Z", "tool": "read_file", "target": "src/api/v1/refund.ts"},
    {"ts": "2026-09-01T10:05:40Z", "tool": "write_file", "target": "src/api/v1/refund.test.ts"},
    {"ts": "2026-09-01T10:06:02Z", "tool": "git_commit", "decision": "allow", "attribution": "agent:agt_claude_desktop_7f21"}
  ],
  "credential_used": {"type": "short_lived", "ttl": "15m", "expired": false}
}