Blended identity is an authorization model that evaluates both the human user and the software agent when deciding whether to grant access. Instead of letting an AI agent inherit a person’s permissions outright, the system considers the requester, the acting agent, the resource, and the policy context at the moment of access.
This matters because AI agents can become non-human actors with real reach into email, cloud apps, and internal tools. In security terms, blended identity helps enforce least privilege, preserve attribution, and reduce blast radius if a prompt injection, stolen token, or misconfigured integration tries to abuse an agent. Defenses built around this model often use workload identities, short-lived credentials, scoped permissions, and audit logs so teams can see which human requested an action and which agent executed it.