Google Cloud's Agent Compute Engine Exposes Non-Human Identity Gap

What happened

Why it matters

• ·Most enterprise AI inventories track human-facing tools, not the non-human identities that agents use to take actions. Without a dedicated agent registry, compliance teams cannot demonstrate to regulators or auditors that access controls cover every active agent. This is now a named expectation in guidance such as the Five Eyes Guidance on the Careful Adoption of Agentic AI Services.
• ·Agents that interact with other agents can accumulate permissions beyond what any single deployment review approved. Least-privilege access must be enforced at runtime, not just at the time an agent is first deployed, or a single compromised agent can escalate access across the entire environment.
• ·Asynchronous agent actions, where an agent completes a task long after a human approved the initial instruction, create a gap in audit trails. Logs must capture what each agent did, when, and on whose authority. Without that, organizations cannot meet the audit readiness standard that banking supervisors, the EU AI Act (Regulation (EU) 2024/1689), and state-level laws are beginning to enforce.

Governance controls affected

What to do now

• ☐Ask your engineering team to provide a complete list of every AI agent currently running in production, including agents that operate on schedules or in the background without direct user interaction, and confirm whether each agent has its own unique identity credential rather than sharing a human user account.
• ☐Review whether your access control program sets specific, narrow permissions for each agent at the point it is deployed, and verify that those permissions cannot expand automatically when the agent interacts with other agents or tools.
• ☐Confirm that your audit logging captures agent-to-agent actions, not only actions that a human directly triggers, so that any agent activity can be traced back to an authorization decision in the event of a regulatory inquiry or incident investigation.
• ☐Update your AI system inventory process to require that every new agent deployment is registered before go-live, with a named business owner, a defined task scope, and a record of what systems and data the agent is permitted to access.
• ☐Brief your legal and compliance leads on the vendor's agent governance guidance and compare its control expectations against what your current AI governance program actually documents, flagging any gaps for remediation before the next internal audit cycle.

What to watch next

Banking supervisors and data protection authorities are actively asking enterprises to prove that AI agents can be audited, a trend that will accelerate as agentic deployments scale. The EU AI Act (Regulation (EU) 2024/1689) enforcement program is expanding. The CCPA Regulations on Automated Decisionmaking Technology, Risk Assessments, and Cybersecurity Audits already require organizations to account for automated systems that affect consumers. Compliance teams should monitor whether Google Cloud's agent registry and non-human identity expectations become a de facto procurement standard. AWS, Microsoft, and other major cloud providers are publishing similar control frameworks in parallel.