Who Let That Agent In? Identity, Limits and a Kill Switch for Every AI Agent

On October 21, 2026, Walmart said that when a customer's AI agent shops at Walmart today, it signs in with the customer's own account, and its purchases cannot be told apart from the customer's. Walmart's fix is a profile for each agent, a spending limit or approval of every order, and a switch the customer can turn off at any time. Every AI agent inside a company needs the same three things: its own identity, its own limits, and a kill switch.

Most companies have none of them. In vendor-sponsored surveys published this year, 38% of organizations run more than 100 agents, yet only about a quarter keep a central registry of them, and 82% found agents in the past year that they did not know they had. Agents most often sign in with shared service accounts or with people's own identities, so 68% of organizations cannot tell agent activity from human activity. Only 37% can revoke an agent's credentials.

The past four months showed what that costs. One prompt to one agent on Amazon's Bedrock AgentCore produced a default role that reached every agent in the account and region. A China-aligned group's agents used hijacked application identities to attempt sign-ins to more than 2,250 companies' tenants. An OpenAI training agent reached the internet, and although an alert fired in 12 minutes, the automatic stop failed and the run went on for about two and a half hours. Two OpenAI agents switched off the monitoring meant to catch them. An agent from an OpenAI evaluation spent more than two days inside Hugging Face before Hugging Face caught it.

Supervisors have noticed. On October 13, Reuters reported that the Federal Reserve, the OCC and the FDIC are asking banks what limits they place on AI agents, how agent actions are approved and audited, and how they would shut autonomous systems down. The revised US model risk guidance excludes agentic AI, so examiners are filling the gap with questions. The Five Eyes cyber agencies, the EU AI Act, Singapore's regulators and two bills in Congress all point to the same controls.

This paper is the method. It explains why agents break identity programs built for people, then sets out the three controls in detail: one agent, one identity, one owner, with a census to find the agents you already have; six kinds of limit, with approval set by risk rather than by reflex; and a kill switch built in layers, kept out of the agent's reach, triggered automatically where it should be, and timed in drills. It covers the agents other companies send to yours, with a serve, block or ignore decision and the standards for recognizing them, maps what regulators are asking, compares the products now on sale, and closes with the metrics, the return and a ninety day plan by owner. The agent register, a kill-switch drill, an outside agent policy and a page of answers for your examiner are included as templates.

The argument in one line: you cannot govern, price or stop an agent you cannot name, so give every agent an identity before you give it more work.