AI agents and non-human identities must exist as first-class IAM users before they act. Start with auditability, access review, and governance in your IAM.