AI agents increasingly act as digital workers that invoke APIs, access enterprise data, delegate tasks, and execute transactions across business systems. Treating agents as anonymous application processes creates unacceptable security and accountability risk because organizations cannot reliably determine who or what acted, under whose authority, with which privileges, or for what purpose. This paper proposes an AI Agent Identity, Access and Authorization Architecture based on Zero Trust, workload identity, least privilege, delegated authority, policy-based access control, short-lived credentials, transaction-level authorization, and continuous verification. The architecture distinguishes human, application, agent, sub-agent, and tool identities; defines trust boundaries and delegation chains; and establishes controls for secrets, impersonation, token exchange, tool permissions, data entitlements, approval gates, and revocation. It also addresses multiagent systems, high-risk transactions, audit evidence, emergency shutdown, and lifecycle governance. The proposed architecture enables enterprises to deploy autonomous agents with strong security, traceability, and business accountability.

Sanjeeve Kumar Gajadi, "AI Agent Identity, Access and Authorization Architecture" International Journal of Scientific Research and Engineering Development, V9(5): Page(1859-1861) September - October 2026. ISSN: 2581-7175. www.ijsred.com. Published by Scientific and Academic Research Publishing.