Judging by their own schedules, organizations are missing the mark on AI agent rollouts 80 percent of the time. Okta’s Customer Identity Trends Report for 2026, just released, highlights the main issue behind the delays. Only 38 percent of consumers are actually willing to let AI agents make decisions on their behalf, with identity infrastructure a key bottleneck to proper adoption.
Okta commissioned two surveys for the report, both conducted in July and August of this year. 5,250 consumers across seven countries were polled, which included the US, UK, Germany and Japan. A further survey consisted of 556 developers and 354 senior leaders in healthcare, financial services, retail and telecom.
The pressure to ship AI is clear whomever you ask about it in professional settings, as it turns out. 52 percent of senior leaders call AI a “must-win capability” for competing over the next two to three years. Nearly a quarter, 23.2 percent, see AI-native competitors as the biggest threat to their business, second only to cybersecurity and data risk (31.4 percent). Even so, only 20.3 percent of respondents say they are shipping AI features at their target pace. Whether this signals improper expectations around shipping or lethargy in the practical rollout isn’t really clear.
Leaders and developers are conflicted
At any rate, the reasons for the delays vary depending on who’s answering questions about it. 59 percent of senior leaders blame supposedly too difficult to achieve compliance, security review or governance. Among developers, just 34.6 percent point to those being the main issues. Developers were nearly twice as likely (17.8 versus 9.0 percent) to say their identity and authentication infrastructure “can’t support agent access patterns.” Given this is what Okta and other identity security vendors are seeking to address, it seems a software solution exists but just isn’t quite as generally accepted just yet culturally or technologically.
Agent authentication is a problem no matter how you slice it. Only 22.4 percent of organizations building agentic capabilities give each agent a unique identity with tightly scoped, time-limited credentials. Others rely on shared service accounts or long-lived API keys (17.4 percent), inherit the user’s token (11.5 percent) or even hardcode credentials (6.4 percent). These are pretty substantial risks for a multitude of reasons. Okta lists four failure modes which are almost inherent to this haphazard agentic identity approach. These are over-permissioning, a large blast radius, lack of behavioral context and credential sprawl. The scale of this issue is thus both multifaceted and considerable. Non-human identities already outnumber human ones by ratios of 45:1 to 144:1, according to one research by Forcepoint.
Consumers want to keep having a say
Meanwhile, on the consumer side, 52 percent say AI in apps and websites is evolving too fast. 38 percent would hand AI some decision-making authority within two years, but only 6 percent want it to act fully autonomously. For low-risk tasks, a majority will let AI act if they can approve the action first or reverse it afterwards.
74 percent of consumers would likely abandon a site that demands account creation before showing prices or reviews. 93 percent link trust to strong security that doesn’t make access difficult.
Agentic control
Unsurprisingly, the report argues that organizations using only an external CIAM platform (such as Okta’s) fare better. 34.4 percent of them have AI features fully in production, compared with 22.3 percent elsewhere. 28.3 percent are on schedule, versus 18.1 percent.
Okta has been building toward integrating agent identity alongside human employee accounts and those for machines for some time. It launched a platform to secure AI agents earlier in the year, registering them in Universal Directory and routing their connections through an Agent Gateway. Together with Google Cloud, it links identity to AI agents, including approval workflows for sensitive actions. Okta also agreed to buy Permiso to add its identity graph to Okta’s identity fabric and is working to tighten agent identity guardrails in many areas, including by discovering them pre-emptively.