The conversation about artificial intelligence in South Africa has shifted rapidly over the past year. What was once the stuff of conferences and pilot projects is now quietly embedding itself in boardrooms and back offices. Among the technologies changing the pace of business are AI agents − autonomous, task-driven systems designed to operate with limited human input. For local firms under pressure from high operating costs, loadshedding disruptions and tightening margins, these agents promise both relief and risk. The promise is efficiency and scale; the risk is exposure, particularly in the realm of cybersecurity.
AI agents are not chatbots in the traditional sense; they represent a new class of digital worker, capable of making decisions, adapting as they learn, and interacting with human colleagues and other systems. For South African companies, this shift carries particular urgency. Our Tech Vision 2025 study shows that nearly 96% of executives globally expect to deploy AI agents more extensively within three years, and over three quarters believe these systems will reinvent the way organisations build and manage digital environments. In South Africa, where the financial sector, retail chains and even municipal services are testing automation at scale, these predictions are not distant possibilities, but practical realities.
The question is not whether local businesses will adopt AI agents, but how they can do so securely. Cybercrime remains a significant cost to the South African economy, with the country ranking among the most targeted in Africa for phishing and ransomware attacks. Introducing millions of autonomous agents into this already fragile digital ecosystem without robust safeguards would be reckless. The task at hand is ensuring that AI agents are treated with the same rigour as human employees when it comes to identity and access management.
Identity management is the cornerstone of trust in digital systems. For people, it involves credentials, permissions and role-based access. For AI agents, it becomes more complex. These systems do not operate in fixed ways; they learn, adjust and sometimes find unanticipated paths to achieve their goals. Traditional methods of granting access and managing privileges are insufficient. Standing privileges − permanent rights assigned to a system or user − pose a particular danger, as they open the door to privilege creep and potential exploitation. Instead, South African organisations will need to adopt more modern approaches rooted in the principles of Zero Trust: trust nothing, verify everything.
Zero Trust models demand continuous validation of every request within a network, regardless of whether it originates from a human or an AI agent.
This approach is not abstract theory. South African banks, for example, have already begun applying adaptive identity verification in mobile channels, adjusting permissions dynamically based on context such as device, location and behaviour. The same thinking must extend to AI agents operating within corporate systems. Context-aware access, just-in-time permissions and lifecycle management from creation through to de-provisioning will become essential to ensure these agents remain both useful and accountable.
Credential management will be another sticking point. AI agents will need multiple keys, tokens and certificates to function effectively. In practice, this means companies must implement systems that can rotate, revoke and refresh these credentials at scale without human error slowing the process down. In a South African setting, where resource constraints in IT departments are common, automation will be key. Tools that can handle credential lifecycles seamlessly will reduce vulnerabilities while freeing up scarce human expertise for higher-level oversight.
Another dimension is regulatory. While South Africa does not yet have dedicated laws for AI agents, it is only a matter of time before global trends shape local frameworks. The EU’s AI Act, which categorises AI applications by risk, is already influencing thinking worldwide. Locally, the Protection of Personal Information Act (POPIA) sets a precedent for data privacy, and it is easy to imagine future amendments or complementary regulations extending to autonomous digital systems. Firms that pre-empt this direction by putting governance frameworks in place − covering fairness, accountability, risk management and transparency − will be better positioned when legislation catches up. Auditors, too, may soon require organisations to demonstrate how they manage AI agent access and activity, just as they do with human employees.
This regulatory anticipation has a practical side. South African firms that trade internationally or work with multinational partners may already face compliance demands that include AI governance. Multinationals are unlikely to tolerate gaps in local subsidiaries that could expose them to global risk. In this sense, securing AI agents is not only a defensive measure, but also a strategic necessity for companies seeking to remain integrated in global value chains.
The scale of the challenge cannot be underestimated. Experts predict millions of AI agents could be operating across networks in the near future, creating an explosion of identities to be managed. Within a South African organisation, this landscape already spans employees, contractors, outsourced partners and now increasingly autonomous systems. Each identity requires secure, efficient management. Without it, the attack surface widens and the cost of breaches escalates. For businesses already grappling with economic pressures, such lapses could be crippling.
Yet, this is not purely a risk narrative. Handled correctly, identity management for AI agents can unlock business acceleration. Dynamic access controls allow agents to be deployed flexibly, scaling up or down as demand fluctuates, a significant advantage in sectors like retail and logistics, where seasonal spikes can strain resources. Ephemeral access, where agents receive temporary permissions to complete specific tasks, ensures agility without long-term exposure. And as AI agents begin to operate in external marketplaces, where organisations may even ‘rent out’ their digital agents to others, strong identity and access management will be the only way to enable trust across boundaries.
For South African business leaders, the message is clear. Securing AI agents is not a technical after thought, but a strategic imperative. It requires investment in modern identity management tools, a shift towards Zero Trust thinking and a readiness to adapt governance frameworks ahead of regulation. In an economy where both resilience and competitiveness are under pressure, businesses that get this right will find themselves not only better protected, but also better positioned to harness the full potential of AI.
For more information contact Jonathan Mahapa, Accenture South Africa,
© Technews Publishing (Pty) Ltd | All Rights Reserved
printer friendly version