--- title: Secure your AI-driven solutions using AI agent identities description: Secure AI-driven solutions using AI agent identities as specialized OAuth 2.0 clients with delegated token exchange and granular access control component: pingoneaic page_id: pingoneaic:identity-for-ai:ai-agent-identities canonical_url: https://docs.pingidentity.com/pingoneaic/identity-for-ai/ai-agent-identities.html llms_txt: https://docs.pingidentity.com/pingoneaic/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md page_aliases: ["release-notes:rapid-channel/ai-agents.adoc"] section_ids: enable-the-ai-agents-feature: Enable the AI agents feature create-an-ai-agent-identity: Create an AI agent identity configure-authentication-flows-for-ai-agent-identities: Configure authentication flows for AI agent identities --- # Secure your AI-driven solutions using AI agent identities Advanced Identity Cloud lets you secure your organization's AI-driven solutions using *AI agent identities*. These are specialized OAuth 2.0 clients that are onboarded with their own identities. They can securely perform tasks on behalf of end users or autonomous agents through a delegated token exchange process, ensuring distinct accountability and granular access control. You can use AI agent identities to securely build [digital assistants](https://developer.pingidentity.com/identity-for-ai/glossary/idai-glossary.html#digital-assistant) that operate on behalf of end users, such as a chatbot on a retail website helping a user navigate products, or an internal workforce assistant acting on behalf of an employee to access enterprise tools like Salesforce. You can also use AI agent identities to securely build [digital workers](https://developer.pingidentity.com/identity-for-ai/glossary/idai-glossary.html#digital-worker) that perform tasks without an end user present, such as an automated pipeline that processes data and updates a dashboard, or a background task that monitors for security threats and takes action when a threat is detected. Advanced Identity Cloud models AI agent identities as OAuth 2.0 clients with their own [agent and privilege](ai-agent-identities-supplementary-information.html#ai-agent-identity-managed-object-types) managed object types. This structure lets you configure AI agent identities to use delegation rather than simple impersonation and ensures that when an AI agent identity requests access to an application, it uses a token exchange process that presents both its own identity and the identity of the end user or autonomous agent. This granular approach to token exchange improves security by preventing unauthorized access and stopping autonomous agents from executing unintended or destructive commands. It also enables "human-in-the-loop" workflows, where end users must explicitly approve high-risk or sensitive operations. You can find a quick summary of the AI agents feature in the [Key capabilities and benefits](ai-agent-identities-supplementary-information.html#key-capabilities-and-benefits). ## Enable the AI agents feature The AI agents feature is enabled by default for tenant environments created on or after the following dates: * March 30, 2026 (sandbox\[[1](#_footnotedef_1 "View footnote.")] environments) * April 14, 2026 (development, UAT\[[2](#_footnotedef_2 "View footnote.")], staging, and production environments) For tenant environments created before those dates, refer to [Enable the AI agents feature](ai-agent-identities-enable.html). ## Create an AI agent identity Use the following steps to create and configure an AI agent identity in Advanced Identity Cloud: 1. Follow the instructions in [Create an AI agent identity](ai-agent-identities-ui.html#create-an-ai-agent-identity). This creates a new AI agent identity, but it doesn't have any privileges or access to applications. 2. Complete the configuration of the AI agent identity by creating custom attributes, configuring its OAuth 2.0 client, and assigning it privileges and access to applications using application policies: * [Update basic settings or custom attributes](ai-agent-identities-ui.html#update-basic-settings-or-custom-attributes) * [Update access settings](ai-agent-identities-ui.html#update-access-settings) * Manage application policies: * [Create application policies](ai-agent-identities-ui.html#create-application-policies) * [Update application policies](ai-agent-identities-ui.html#update-application-policies) ## Configure authentication flows for AI agent identities * [Configure an "on behalf of" authentication flow for AI agents](ai-agent-identities-configure-on-behalf-of-authentication-flow.html)\ The "on behalf of" flow allows an AI agent to perform actions on behalf of an end user, which is useful for securing the actions of assistants. * [Configure an autonomous AI agent flow](ai-agent-identities-configure-autonomous-agent-flow.html)\ The autonomous AI agent flow lets an AI agent act independently, without requiring an end user to be present, which is useful for automated pipelines and background tasks. * [Configure a DCR onboarding flow](ai-agent-identities-configure-dcr-onboarding-flow.html)\ To streamline the onboarding of OAuth 2.0 clients, Advanced Identity Cloud supports Dynamic Client Registration (DCR), which allows for the automated creation and configuration of dynamic clients without manual intervention. *** [1](#_footnoteref_1). A [sandbox environment](../tenants/environments-sandbox.html) is an [add-on capability](../product-information/add-on-capabilities.html).[2](#_footnoteref_2). A [user acceptance testing (UAT) environment](../tenants/environments-uat.html) is an [add-on capability](../product-information/add-on-capabilities.html).