Marionettes and ghosts: Security considerations when AI agents join your

Marionettes, ghosts and the digital workforce

Every organization is racing to deploy AI agents, a new generation of digital workers that don't appear on the org chart. This digital workforce doesn’t sleep, doesn’t question orders and doesn’t slow down. 

Autonomous AI agents are already executing thousands of decisions per second inside critical enterprise systems. The productivity gains are real, but so is the governance challenge. 

Are they truly investments, a competitive advantage or a liability? Who governs them? And who is accountable when something goes wrong?

As nonhuman identities outnumber people and AI agents begin executing workflows, approving transactions and interacting with core business systems, a fundamental question emerges: when autonomous systems make decisions, who owns the outcome?

NTT DATA’s perspective with Microsoft, explores two approaches to agent identity:

The marionette: an AI agent inherits the identity and permissions of its creator. It’s powerful and efficient, but potentially difficult to govern if credentials are compromised.

The ghost: an AI agent operates as its own identity, with tightly defined permissions, enabling stronger oversight, auditing and accountability.