{"id":1373,"date":"2026-09-16T19:56:37","date_gmt":"2026-09-16T17:56:37","guid":{"rendered":"https:\/\/wertfels.com\/white-paper-agent-identity-banks-insurers\/"},"modified":"2026-09-26T21:57:03","modified_gmt":"2026-09-26T19:57:03","slug":"white-paper-agent-identity-banks-insurers","status":"publish","type":"page","link":"https:\/\/wertfels.com\/en\/white-paper-agent-identity-banks-insurers\/","title":{"rendered":"White paper: agent identity for banks and insurers"},"content":{"rendered":"    <section id=\"block_b76304b6a6cf0d152f11590accc28449\"\n             class=\"hero-home is-hero\"             data-section>\n\n        <figure class=\"hero-home__bg m-cover\" aria-hidden=\"true\">\n            <img decoding=\"async\" width=\"2880\" height=\"1612\" src=\"https:\/\/wertfels.com\/wp-content\/uploads\/2026\/08\/videoframe_0-3.webp\" class=\"skip-lazy\" alt=\"Abstract blue mountain background\" loading=\"eager\" fetchpriority=\"high\" srcset=\"https:\/\/wertfels.com\/wp-content\/uploads\/2026\/08\/videoframe_0-3-1920x1075.webp 1920w, https:\/\/wertfels.com\/wp-content\/uploads\/2026\/08\/videoframe_0-3-1440x806.webp 1440w, https:\/\/wertfels.com\/wp-content\/uploads\/2026\/08\/videoframe_0-3-1280x716.webp 1280w, https:\/\/wertfels.com\/wp-content\/uploads\/2026\/08\/videoframe_0-3-767x429.webp 767w, https:\/\/wertfels.com\/wp-content\/uploads\/2026\/08\/videoframe_0-3-300x168.webp 300w, https:\/\/wertfels.com\/wp-content\/uploads\/2026\/08\/videoframe_0-3.webp 2880w\" sizes=\"(max-width: 2880px) 100vw, 2880px\" title=\"videoframe_0-3\" \/>                            <video data-src=\"https:\/\/wertfels.com\/wp-content\/uploads\/2026\/08\/Main-container_3.mp4\" data-autoplay muted data-loop playsinline><\/video>\n                    <\/figure>\n\n        <div class=\"hero-home__inner container\">\n\n            <div class=\"hero-home__content\">\n                                    <h1 class=\"hero-home__title h-52 h-38-m\">AI agents with access<br><mark>but without identity<\/mark><\/h1>\n                \n                                    <div class=\"hero-home__text txt-16 txt-16-m\">\n                        <p>AI agents, service accounts and technical users at banks and insurers: ownership, controls and what DORA requires.<\/p>\n                    <\/div>\n                \n                                    <div class=\"hero-home__actions\">    <a href=\"https:\/\/wertfels.com\/wp-content\/uploads\/2026\/09\/WertFels_WhitePaper_AgentIdentity_EN.pdf\" class=\"btn btn--arrow\" title=\"Download the white paper as a PDF\" target=\"_blank\" rel=\"noopener noreferrer\">\r\n        Download the white paper as a PDF    <\/a>\r\n    <\/div>                            <\/div>\n\n                    <\/div>\n    <\/section>\n\n\n        <section id=\"block_4736a5a4a13764be17f6172f341ff0cc\"\n                 class=\"content-challenges section\"                 data-section data-theme=\"light\">\n\n            <div class=\"content-challenges__inner container\"><div class=\"content-challenges__header section-header\">\n                                            <p class=\"content-challenges__tag title-tag\">What it is about<\/p>\n                    \n                    <div class=\"content-challenges__head-row section-header__row\">\n                                                    <h2 class=\"content-challenges__title section-header__title h-40 h-32-m\">Four findings<\/h2>\n                        \n                                                    <div class=\"content-challenges__text section-header__text txt-16 txt-16-m\">\n                                <p>AI models and agents access the same systems as employees. These non-human identities go through procedures that were built for humans.<\/p>\n                            <\/div>\n                                            <\/div>\n                <\/div><div class=\"wf-bf\"><div class=\"bf-raster\">\n\n  <article class=\"bf-k\">\n   <div class=\"bf-bild\"><svg viewBox=\"0 0 440 250\" aria-hidden=\"true\">\n    <g transform=\"translate(34,120)\"><rect class=\"box\" x=\"-6\" y=\"-36\" width=\"96\" height=\"72\" rx=\"14\"\/><text class=\"t\" x=\"42\" y=\"-8\" text-anchor=\"middle\">INTEGRATION<\/text><text x=\"42\" y=\"12\" text-anchor=\"middle\" style=\"font:500 13px Inter,sans-serif;fill:#0B1220\">Sales app<\/text><\/g>\n    <g transform=\"translate(300,120)\"><rect class=\"box\" x=\"0\" y=\"-44\" width=\"112\" height=\"88\" rx=\"14\"\/><text class=\"t\" x=\"56\" y=\"-14\" text-anchor=\"middle\">SALESFORCE<\/text>\n     <rect x=\"18\" y=\"0\" width=\"76\" height=\"8\" rx=\"4\" fill=\"#E4E8F2\"\/><rect x=\"18\" y=\"16\" width=\"56\" height=\"8\" rx=\"4\" fill=\"#E4E8F2\"\/><\/g>\n    <g class=\"t-mfa\" transform=\"translate(212,120)\"><rect x=\"-26\" y=\"-44\" width=\"52\" height=\"88\" rx=\"12\" fill=\"#fff\" stroke=\"#E1E5EE\"\/><text class=\"t\" x=\"0\" y=\"-18\" text-anchor=\"middle\">MFA<\/text><rect x=\"-10\" y=\"-6\" width=\"20\" height=\"16\" rx=\"3\" fill=\"none\" stroke=\"#6E7891\" stroke-width=\"1.6\"\/><path d=\"M-6 -6v-4a6 6 0 0 1 12 0v4\" fill=\"none\" stroke=\"#6E7891\" stroke-width=\"1.6\"\/><\/g>\n    <path d=\"M212 150 C 212 196, 212 196, 212 204\" stroke=\"#D5DAE6\" stroke-width=\"1.5\"\/>\n    <text class=\"t\" x=\"212\" y=\"222\" text-anchor=\"middle\">NEVER ASKED<\/text>\n    <g transform=\"translate(76,64)\"><g class=\"t-dieb\"><rect x=\"-44\" y=\"-16\" width=\"88\" height=\"30\" rx=\"15\" fill=\"#0B1220\"\/><text class=\"tw\" x=\"0\" y=\"3\" text-anchor=\"middle\">STOLEN<\/text><\/g><\/g>\n    <g transform=\"translate(92,120)\"><g class=\"t-tok\"><circle r=\"17\" fill=\"#204DFF\" stroke=\"#fff\" stroke-width=\"3\"\/><circle cx=\"-4\" r=\"5\" fill=\"none\" stroke=\"#fff\" stroke-width=\"2.2\"\/><path d=\"M1 0h10M8 0v5\" stroke=\"#fff\" stroke-width=\"2.2\" stroke-linecap=\"round\"\/><\/g><\/g>\n    <g transform=\"translate(300,120)\"><rect class=\"t-daten\" x=\"-24\" y=\"-24\" width=\"18\" height=\"12\" rx=\"3\" fill=\"#204DFF\"\/><rect class=\"t-daten\" x=\"-24\" y=\"-4\" width=\"18\" height=\"12\" rx=\"3\" fill=\"#204DFF\"\/><rect class=\"t-daten\" x=\"-24\" y=\"16\" width=\"18\" height=\"12\" rx=\"3\" fill=\"#204DFF\"\/><\/g>\n    <text class=\"tb\" x=\"76\" y=\"178\" text-anchor=\"middle\">OAUTH TOKEN<\/text>\n   <\/svg><\/div>\n   <div class=\"bf-zeile\"><i><svg viewBox=\"0 0 24 24\"><circle cx=\"8\" cy=\"12\" r=\"4\"\/><path d=\"M12 12h9M18 12v3\"\/><\/svg><\/i><span>Finding 1 \u00b7 Stolen tokens<\/span><\/div>\n   <h3>A valid token needs no sign-in<\/h3>\n   <p>In August 2025 attackers used stolen OAuth tokens of the sales application Salesloft Drift to exfiltrate data from the Salesforce environments of many companies. According to Google Threat Intelligence, the attackers used compromised but valid tokens of the integration. As a result, no sign-in was needed and hence no multi-factor prompt that could have attracted attention.<\/p>\n   <p class=\"quelle\">White paper, chapter 1 \u00b7 based on Google Threat Intelligence, 26 August 2025<\/p>\n  <\/article>\n\n  <article class=\"bf-k\">\n   <div class=\"bf-bild\"><svg viewBox=\"0 0 440 250\" aria-hidden=\"true\" id=\"wf-bf-agent\">\n    <text class=\"t\" x=\"26\" y=\"34\">SERVICE ACCOUNT<\/text>\n    <g transform=\"translate(26,52)\"><rect class=\"box\" width=\"70\" height=\"34\" rx=\"10\"\/><text x=\"35\" y=\"22\" text-anchor=\"middle\" style=\"font:500 12px Inter,sans-serif;fill:#0B1220\">Account<\/text><\/g>\n    <path class=\"s-fix\" d=\"M96 69 H300\"\/>\n    <g transform=\"translate(300,52)\"><rect class=\"box\" width=\"112\" height=\"34\" rx=\"10\"\/><text x=\"56\" y=\"22\" text-anchor=\"middle\" style=\"font:500 12px Inter,sans-serif;fill:#0B1220\">always the same<\/text><\/g>\n    <path d=\"M22 110 H418\" stroke=\"#E1E5EE\" stroke-dasharray=\"3 5\"\/>\n    <text class=\"tb\" x=\"26\" y=\"136\">AI AGENT<\/text>\n    <g transform=\"translate(26,168)\"><rect width=\"70\" height=\"40\" rx=\"12\" fill=\"#204DFF\"\/><text class=\"tw\" x=\"35\" y=\"25\" text-anchor=\"middle\">GOAL<\/text><\/g>\n    <path class=\"a-pfad\" data-w=\"0\" d=\"M96 188 C 170 188, 190 142, 262 142\"\/>\n    <path class=\"a-pfad\" data-w=\"1\" d=\"M96 188 H262\"\/>\n    <path class=\"a-pfad\" data-w=\"2\" d=\"M96 188 C 170 188, 190 234, 262 234\"\/>\n    <g class=\"a-w\" data-w=\"0\" transform=\"translate(262,128)\"><rect width=\"150\" height=\"28\" rx=\"9\"\/><text x=\"14\" y=\"18.5\" style=\"font:500 12px Inter,sans-serif;fill:#0B1220\">Tool: search<\/text><\/g>\n    <g class=\"a-w\" data-w=\"1\" transform=\"translate(262,174)\"><rect width=\"150\" height=\"28\" rx=\"9\"\/><text x=\"14\" y=\"18.5\" style=\"font:500 12px Inter,sans-serif;fill:#0B1220\">Tool: booking<\/text><\/g>\n    <g class=\"a-w\" data-w=\"2\" transform=\"translate(262,220)\"><rect width=\"150\" height=\"28\" rx=\"9\"\/><text x=\"14\" y=\"18.5\" style=\"font:500 12px Inter,sans-serif;fill:#0B1220\">Tool: email<\/text><\/g>\n   <\/svg><\/div>\n   <div class=\"bf-zeile\"><i><svg viewBox=\"0 0 24 24\"><path d=\"M12 3l2.2 5.3L20 9l-4.5 3.6L17 19l-5-3-5 3 1.5-6.4L4 9l5.8-.7z\"\/><\/svg><\/i><span>Finding 2 \u00b7 New class<\/span><\/div>\n   <h3>An AI agent is not just another service account<\/h3>\n   <p>A service account does what was defined when it was created. An agent receives a goal and decides for itself at runtime which tools it calls. A fixed list of rights does not describe it.<\/p>\n   <p class=\"quelle\">White paper, chapter 3 \u00b7 NIST NCCoE calls least privilege for agents an open question<\/p>\n  <\/article>\n\n  <article class=\"bf-k\">\n   <div class=\"bf-bild\"><svg viewBox=\"0 0 440 250\" aria-hidden=\"true\">\n    <g transform=\"translate(150,40)\" style=\"font:600 10.5px Inter,sans-serif;fill:#6E7891;letter-spacing:.06em\">\n     <text x=\"0\" y=\"0\">JAN<\/text><text x=\"126\" y=\"0\" text-anchor=\"middle\">JUL<\/text><text x=\"252\" y=\"0\" text-anchor=\"end\">DEC<\/text><\/g>\n    <g style=\"font:500 12.5px Inter,sans-serif;fill:#0B1220\"><text x=\"26\" y=\"84\">Employees<\/text><text x=\"26\" y=\"134\">Service accounts<\/text><text x=\"26\" y=\"184\">AI agents<\/text><\/g>\n    <g transform=\"translate(150,0)\">\n     <rect class=\"f-m\" x=\"0\" y=\"66\" width=\"252\" height=\"26\" rx=\"13\"\/><rect class=\"f-m\" x=\"0\" y=\"116\" width=\"252\" height=\"26\" rx=\"13\"\/><rect class=\"f-m\" x=\"0\" y=\"166\" width=\"252\" height=\"26\" rx=\"13\"\/>\n     <circle class=\"f-h\" cx=\"126\" cy=\"79\" r=\"7\"\/><circle class=\"f-h\" cx=\"126\" cy=\"129\" r=\"7\"\/><circle class=\"f-h\" cx=\"126\" cy=\"179\" r=\"7\"\/>\n     <circle class=\"f-p\" cx=\"244\" cy=\"79\" r=\"8\"\/><circle class=\"f-p\" cx=\"244\" cy=\"129\" r=\"8\"\/><circle class=\"f-p\" cx=\"244\" cy=\"179\" r=\"8\"\/>\n     <g class=\"f-lauf\"><path d=\"M0 56 V202\" stroke=\"#204DFF\" stroke-width=\"1.5\" stroke-dasharray=\"3 4\"\/><\/g>\n    <\/g>\n    <g transform=\"translate(150,216)\"><circle cx=\"6\" cy=\"0\" r=\"6\" fill=\"#204DFF\"\/><text class=\"t\" x=\"18\" y=\"4\">YEARLY<\/text><circle cx=\"104\" cy=\"0\" r=\"5.5\" fill=\"#fff\" stroke=\"#204DFF\" stroke-width=\"2\"\/><text class=\"t\" x=\"116\" y=\"4\">CRITICAL SIX-MONTHLY<\/text><\/g>\n   <\/svg><\/div>\n   <div class=\"bf-zeile\"><i><svg viewBox=\"0 0 24 24\"><rect x=\"4\" y=\"5\" width=\"16\" height=\"15\" rx=\"2.5\"\/><path d=\"M4 10h16M9 3v4M15 3v4\"\/><\/svg><\/i><span>Finding 3 \u00b7 DORA<\/span><\/div>\n   <h3>DORA makes no exception for technical accounts<\/h3>\n   <p>The DORA RTS requires access rights to be updated at least once a year, and at least every six months for systems supporting critical or important functions. The text contains no exception for technical accounts.<\/p>\n   <p class=\"quelle\">White paper, chapter 2 \u00b7 DORA delegated regulation<\/p>\n  <\/article>\n\n  <article class=\"bf-k\">\n   <div class=\"bf-bild\"><svg viewBox=\"0 0 440 250\" aria-hidden=\"true\">\n    <g transform=\"translate(220,178)\"><rect x=\"-56\" y=\"-26\" width=\"112\" height=\"52\" rx=\"14\" fill=\"#204DFF\"\/><text class=\"tw\" x=\"0\" y=\"5\" text-anchor=\"middle\">AI AGENT<\/text><\/g>\n    <path class=\"e-alt\" d=\"M110 122 C 110 146, 164 150, 164 162\"\/>\n    <path class=\"e-link\" d=\"M220 122 V152\"\/>\n    <path d=\"M330 122 C 330 146, 276 150, 276 162\" fill=\"none\" stroke=\"#C9D2EE\" stroke-width=\"2\" stroke-dasharray=\"4 4\"\/>\n    <g class=\"e-weg\"><g transform=\"translate(110,62)\"><circle r=\"26\" fill=\"#fff\" stroke=\"#E1E5EE\"\/><circle cy=\"-6\" r=\"7\" fill=\"#0B1220\"\/><path d=\"M-12 14c2-8 7-11 12-11s10 3 12 11\" fill=\"#0B1220\"\/><\/g><text class=\"t\" x=\"110\" y=\"112\" text-anchor=\"middle\">OWNER<\/text><\/g>\n    <g transform=\"translate(220,62)\"><circle r=\"26\" fill=\"#fff\" stroke=\"#E1E5EE\"\/><circle cy=\"-6\" r=\"7\" fill=\"#0B1220\"\/><path d=\"M-12 14c2-8 7-11 12-11s10 3 12 11\" fill=\"#0B1220\"\/><\/g><text class=\"t\" x=\"220\" y=\"112\" text-anchor=\"middle\">DEPUTY<\/text>\n    <g class=\"e-kron\" transform=\"translate(242,40)\"><circle r=\"10\" fill=\"#204DFF\"\/><path d=\"M-4.5 0l3 3 6-6.5\" stroke=\"#fff\" stroke-width=\"2\" fill=\"none\" stroke-linecap=\"round\"\/><\/g>\n    <g transform=\"translate(330,62)\"><rect x=\"-26\" y=\"-22\" width=\"52\" height=\"44\" rx=\"10\" fill=\"#fff\" stroke=\"#E1E5EE\"\/><rect x=\"-14\" y=\"-10\" width=\"28\" height=\"7\" rx=\"2\" fill=\"#C9D2EE\"\/><rect x=\"-14\" y=\"2\" width=\"28\" height=\"7\" rx=\"2\" fill=\"#C9D2EE\"\/><\/g><text class=\"t\" x=\"330\" y=\"112\" text-anchor=\"middle\">APPLICATION<\/text>\n    <text class=\"tb\" x=\"220\" y=\"236\" text-anchor=\"middle\">SUCCESSION INSTEAD OF SHUTDOWN<\/text>\n   <\/svg><\/div>\n   <div class=\"bf-zeile\"><i><svg viewBox=\"0 0 24 24\"><circle cx=\"12\" cy=\"8\" r=\"3.5\"\/><path d=\"M5.5 20c1-4 3.6-6 6.5-6s5.5 2 6.5 6\"\/><\/svg><\/i><span>Finding 4 \u00b7 Responsibility<\/span><\/div>\n   <h3>Every agent needs a human who answers for it<\/h3>\n   <p>Every agent needs exactly one human owner, one deputy and an anchor in an application. When the owner leaves, the agent is transferred along a succession chain instead of being decommissioned.<\/p>\n   <p class=\"quelle\">White paper, chapter 7 \u00b7 Responsibility and lifecycle<\/p>\n  <\/article>\n\n <\/div>\n <div class=\"bf-fuss\"><a class=\"btn btn--arrow\" href=\"\/wp-content\/uploads\/2026\/09\/WertFels_WhitePaper_AgentIdentity_EN.pdf\" target=\"_blank\" rel=\"noopener\">Download the white paper<\/a><\/div><\/div><\/div><\/section><style id=\"wf-bf-css\">.wf-bf .bf-raster{display:grid;grid-template-columns:repeat(2,1fr);gap:28px}\n.wf-bf .bf-k{position:relative;background:#fff;border:1px solid #E6E9F0;border-radius:22px;padding:22px 22px 28px;box-shadow:0 18px 40px -30px rgba(11,18,32,.35);transition:transform .35s cubic-bezier(.3,.9,.4,1),box-shadow .35s,border-color .35s;overflow:hidden}\n.wf-bf .bf-k::before{content:\"\";position:absolute;left:0;right:0;top:0;height:3px;background:#204DFF}\n.wf-bf .bf-k:hover{transform:translateY(-6px);box-shadow:0 30px 60px -32px rgba(32,77,255,.45);border-color:#C9D3FF}\n.wf-bf .bf-bild{position:relative;isolation:isolate;height:250px;border-radius:16px;background:#F4F4F4;overflow:hidden}\n.wf-bf .bf-bild::before{content:\"\";position:absolute;inset:0;z-index:-1;background-image:radial-gradient(circle,#CDCDCD 1.1px,transparent 1.5px);background-size:20px 20px;background-position:10px 10px;-webkit-mask-image:radial-gradient(ellipse 72% 68% at 50% 52%,#000 40%,transparent 100%);mask-image:radial-gradient(ellipse 72% 68% at 50% 52%,#000 40%,transparent 100%)}\n.wf-bf .bf-bild svg{width:100%;height:100%;display:block}\n.wf-bf .bf-zeile{display:flex;align-items:center;gap:12px;margin:24px 8px 0}\n.wf-bf .bf-zeile i{flex:0 0 38px;height:38px;border-radius:10px;background:#E8EDFF;display:grid;place-items:center;transition:background .3s}\n.wf-bf .bf-zeile i svg{width:20px;height:20px;stroke:#204DFF;fill:none;stroke-width:2;stroke-linecap:round;stroke-linejoin:round;transition:stroke .3s}\n.wf-bf .bf-k:hover .bf-zeile i{background:#204DFF}.bf-k:hover .bf-zeile i svg{stroke:#fff}\n.wf-bf .bf-zeile span{font:600 13.5px Inter,sans-serif;letter-spacing:.06em;text-transform:uppercase;color:#204DFF}\n.wf-bf .bf-k h3{margin:16px 8px 0;font:600 27px\/1.2 Epilogue,sans-serif;letter-spacing:-.01em}\n.wf-bf .bf-k p{margin:12px 8px 0;font-size:17px;line-height:1.55;color:#5B6272}\n.wf-bf .bf-k .quelle{margin:16px 8px 0;font-size:13px;color:#8A93A8}\n.wf-bf .bf-fuss{margin-top:44px;display:flex;justify-content:center}\nsection.content-challenges:has(.wf-bf){padding-bottom:48px}\n@media (max-width:767px){section.content-challenges:has(.wf-bf){padding-bottom:32px}}\n.wf-bf .bf-btn{display:inline-flex;align-items:center;gap:14px;background:#204DFF;color:#fff;text-decoration:none;font:500 16px Inter,sans-serif;padding:8px 8px 8px 22px;border-radius:40px;box-shadow:0 8px 18px -10px rgba(32,77,255,.65);transition:transform .2s,box-shadow .2s}\n.wf-bf .bf-btn:hover{transform:translateY(-1px);box-shadow:0 12px 24px -12px rgba(32,77,255,.75)}\n.wf-bf .bf-btn b{width:38px;height:38px;border-radius:50%;background:#fff;display:grid;place-items:center}\n.wf-bf .t{font:600 11px Inter,sans-serif;letter-spacing:.08em;fill:#6E7891}\n.wf-bf .tb{font:600 11px Inter,sans-serif;letter-spacing:.08em;fill:#204DFF}\n.wf-bf .tw{font:600 11px Inter,sans-serif;letter-spacing:.06em;fill:#fff}\n.wf-bf .box{fill:#fff;stroke:#E1E5EE;stroke-width:1.2}\n.wf-bf .t-tok{animation:wfbf-t-tok 7s cubic-bezier(.5,0,.3,1) infinite}\n@keyframes wfbf-t-tok{0%,6%{transform:translate(0,0)}30%{transform:translate(118px,-58px)}44%,52%{transform:translate(236px,0)}70%,100%{transform:translate(236px,0)}}\n.wf-bf .t-dieb{opacity:0;animation:wfbf-t-dieb 7s infinite}\n@keyframes wfbf-t-dieb{0%,24%{opacity:0}30%,92%{opacity:1}100%{opacity:0}}\n.wf-bf .t-mfa{animation:wfbf-t-mfa 7s infinite}\n@keyframes wfbf-t-mfa{0%,34%{opacity:1}40%,92%{opacity:.35}100%{opacity:1}}\n.wf-bf .t-daten{opacity:0;animation:wfbf-t-dat 7s infinite}\n.wf-bf .t-daten:nth-of-type(2){animation-delay:.35s}.t-daten:nth-of-type(3){animation-delay:.7s}\n@keyframes wfbf-t-dat{0%,52%{opacity:0;transform:translateX(0)}58%{opacity:1}80%{opacity:1;transform:translateX(-120px)}86%,100%{opacity:0;transform:translateX(-120px)}}\n.wf-bf .a-pfad{fill:none;stroke:#D5DAE6;stroke-width:2;transition:stroke .3s}\n.wf-bf .a-pfad.an{stroke:#204DFF;stroke-width:2.5}\n.wf-bf .a-w rect{fill:#fff;stroke:#E1E5EE;transition:fill .3s,stroke .3s}\n.wf-bf .a-w.an rect{fill:#E8EDFF;stroke:#204DFF}\n.wf-bf .s-fix{stroke:#0B1220;stroke-width:2;fill:none;stroke-dasharray:5 5;animation:wfbf-s-lauf 1.2s linear infinite}\n@keyframes wfbf-s-lauf{to{stroke-dashoffset:-20}}\n.wf-bf .f-m{fill:#fff;stroke:#E1E5EE}\n.wf-bf .f-h{fill:#fff;stroke:#204DFF;stroke-width:2.5;transform-box:fill-box;transform-origin:center;animation:wfbf-f-p 6s infinite 3s}\n.wf-bf .f-p{fill:#204DFF;transform-box:fill-box;transform-origin:center;animation:wfbf-f-p 6s infinite}\n@keyframes wfbf-f-p{0%,100%{transform:scale(1)}8%{transform:scale(1.35)}16%{transform:scale(1)}}\n.wf-bf .f-lauf{animation:wfbf-f-lauf 6s linear infinite}\n@keyframes wfbf-f-lauf{from{transform:translateX(0)}to{transform:translateX(252px)}}\n.wf-bf .e-person{transition:opacity .4s}\n.wf-bf .e-weg{animation:wfbf-e-weg 8s infinite}\n@keyframes wfbf-e-weg{0%,30%{opacity:1;transform:none}40%,86%{opacity:.2;transform:translateY(8px)}96%,100%{opacity:1;transform:none}}\n.wf-bf .e-link{fill:none;stroke:#204DFF;stroke-width:2.5;stroke-dasharray:120;animation:wfbf-e-link 8s infinite}\n@keyframes wfbf-e-link{0%,40%{stroke-dashoffset:120}52%,86%{stroke-dashoffset:0}96%,100%{stroke-dashoffset:120}}\n.wf-bf .e-alt{fill:none;stroke:#204DFF;stroke-width:2.5;animation:wfbf-e-alt 8s infinite}\n@keyframes wfbf-e-alt{0%,30%{opacity:1}38%,92%{opacity:0}100%{opacity:1}}\n.wf-bf .e-kron{animation:wfbf-e-kron 8s infinite}\n@keyframes wfbf-e-kron{0%,48%{opacity:0}56%,86%{opacity:1}96%,100%{opacity:0}}\n.wf-bf .bf-k:hover svg *{animation-duration:5s!important}\n@media (max-width:900px){.wf-bf .bf-raster{grid-template-columns:1fr}.wf-bf .bf-kopf{grid-template-columns:1fr;gap:16px}.wf-bf .bf-kopf h2{font-size:32px}.wf-bf .bf-k h3{font-size:23px}.wf-bf .bf-bild{height:220px}}\n@media (prefers-reduced-motion:reduce){.wf-bf svg *{animation:none!important}}\n@media (max-width:560px){.wf-bf .bf-bild{height:auto;aspect-ratio:440\/250}}\n.wf-bf .bf-fuss{margin-top:44px;display:flex;justify-content:center}\nsection.content-challenges:has(.wf-bf){padding-bottom:48px}\n@media (max-width:767px){section.content-challenges:has(.wf-bf){padding-bottom:32px}}<\/style><script id=\"wf-bf-js\">\n(function(){\n var s=document.getElementById('wf-bf-agent');if(!s||matchMedia('(prefers-reduced-motion:reduce)').matches)return;\n var ord=[1,0,2,0,1,2],i=0;\n function zeig(){var w=ord[i%ord.length];s.querySelectorAll('[data-w]').forEach(function(e){e.classList.toggle('an',+e.getAttribute('data-w')===w);});i++;}\n zeig();setInterval(zeig,1400);\n})();\n<\/script>\n    \n\n            <section id=\"block_11c86d39dc1da7f34413edcb9bc967a5\"\n                     class=\"accordion-faq section\"                     data-section data-theme=\"light\">\n\n                <div class=\"accordion-faq__inner container\">\n\n                                            <div class=\"accordion-faq__tag-row\">\n                            <p class=\"accordion-faq__tag title-tag\">FAQ<\/p>\n                        <\/div>\n                    \n                    <div class=\"accordion-faq__row\">\n                        <div class=\"accordion-faq__aside\">\n                                                            <div class=\"accordion-faq__header\">\n                                                                            <h2 class=\"accordion-faq__title h-40 h-32-m\">Common questions<\/h2>\n                                    \n                                                                            <div class=\"accordion-faq__text txt-16 txt-16-m\">Answers to the questions banks and insurers ask us about AI agents, non-human identities and DORA.<\/div>\n                                                                    <\/div>\n                            \n                                                            <div class=\"accordion-faq__cta-card\">\n                                                                            <div class=\"accordion-faq__cta-text\">\n                                                                                            <p class=\"accordion-faq__cta-title h-28 h-22-m\">Questions about the white paper?<\/p>\n                                            \n                                                                                            <p class=\"accordion-faq__cta-desc txt-16 txt-16-m\">We will answer them in an initial call.<\/p>\n                                                                                    <\/div>\n                                    \n                                                                                <a href=\"\/en\/#contact\" class=\"btn btn--arrow\" title=\"Ask a question\" target=\"_self\">\r\n        Ask a question    <\/a>\r\n                                                                        <\/div>\n                                                    <\/div>\n\n                        <div class=\"accordion-faq__list\" data-accordion=\"single\" data-section>\n                                                            <div class=\"accordion-faq__item accordion__item \">\n                                    <h3 class=\"accordion-faq__trigger-heading accordion__trigger-heading h-24 h-22-m\">Does DORA also apply to AI agents?                                        <button class=\"accordion-faq__trigger accordion__trigger\" type=\"button\"\n                                                aria-expanded=\"false\" aria-label=\"Does DORA also apply to AI agents?\">\n                                            <span class=\"accordion-faq__icon accordion__icon\" aria-hidden=\"true\"><\/span>\n                                        <\/button>\n                                    <\/h3>\n\n                                                                            <div class=\"accordion-faq__panel accordion__panel\" aria-hidden=\"true\">\n                                            <div class=\"accordion-faq__panel-inner accordion__panel-inner txt-14\"><p>The regulation does not mention AI agents. The obligations still apply to them: lifecycle, logging and recertification apply to all accounts, regardless of account type. Article 20 addresses only one requirement explicitly to employees: one unique account per identity.<\/p>\n<\/div>\n                                        <\/div>\n                                                                    <\/div>\n                                                            <div class=\"accordion-faq__item accordion__item \">\n                                    <h3 class=\"accordion-faq__trigger-heading accordion__trigger-heading h-24 h-22-m\">Does every AI agent need its own account?                                        <button class=\"accordion-faq__trigger accordion__trigger\" type=\"button\"\n                                                aria-expanded=\"false\" aria-label=\"Does every AI agent need its own account?\">\n                                            <span class=\"accordion-faq__icon accordion__icon\" aria-hidden=\"true\"><\/span>\n                                        <\/button>\n                                    <\/h3>\n\n                                                                            <div class=\"accordion-faq__panel accordion__panel\" aria-hidden=\"true\">\n                                            <div class=\"accordion-faq__panel-inner accordion__panel-inner txt-14\"><p>Yes, otherwise accountability is lost. Article 21 requires that actions can be attributed to a user at all times. A single account shared by several agents does not meet this.<\/p>\n<\/div>\n                                        <\/div>\n                                                                    <\/div>\n                                                            <div class=\"accordion-faq__item accordion__item \">\n                                    <h3 class=\"accordion-faq__trigger-heading accordion__trigger-heading h-24 h-22-m\">What distinguishes an AI agent from a service account?                                        <button class=\"accordion-faq__trigger accordion__trigger\" type=\"button\"\n                                                aria-expanded=\"false\" aria-label=\"What distinguishes an AI agent from a service account?\">\n                                            <span class=\"accordion-faq__icon accordion__icon\" aria-hidden=\"true\"><\/span>\n                                        <\/button>\n                                    <\/h3>\n\n                                                                            <div class=\"accordion-faq__panel accordion__panel\" aria-hidden=\"true\">\n                                            <div class=\"accordion-faq__panel-inner accordion__panel-inner txt-14\"><p>A service account does what was defined when it was created. An AI agent is given a goal and chooses its tools itself, steered by a language model. Its set of actions is only determined at runtime.<\/p>\n<\/div>\n                                        <\/div>\n                                                                    <\/div>\n                                                            <div class=\"accordion-faq__item accordion__item \">\n                                    <h3 class=\"accordion-faq__trigger-heading accordion__trigger-heading h-24 h-22-m\">Under which identity does an AI agent act?                                        <button class=\"accordion-faq__trigger accordion__trigger\" type=\"button\"\n                                                aria-expanded=\"false\" aria-label=\"Under which identity does an AI agent act?\">\n                                            <span class=\"accordion-faq__icon accordion__icon\" aria-hidden=\"true\"><\/span>\n                                        <\/button>\n                                    <\/h3>\n\n                                                                            <div class=\"accordion-faq__panel accordion__panel\" aria-hidden=\"true\">\n                                            <div class=\"accordion-faq__panel-inner accordion__panel-inner txt-14\"><p>Under its own identity, acting with delegated authority. If it acts under a human&#8217;s identity, that person&#8217;s name appears in every log. Since 2020, OAuth 2.0 Token Exchange has separated the actor from the principal.<\/p>\n<\/div>\n                                        <\/div>\n                                                                    <\/div>\n                                                            <div class=\"accordion-faq__item accordion__item \">\n                                    <h3 class=\"accordion-faq__trigger-heading accordion__trigger-heading h-24 h-22-m\">What happens when the owner leaves?                                        <button class=\"accordion-faq__trigger accordion__trigger\" type=\"button\"\n                                                aria-expanded=\"false\" aria-label=\"What happens when the owner leaves?\">\n                                            <span class=\"accordion-faq__icon accordion__icon\" aria-hidden=\"true\"><\/span>\n                                        <\/button>\n                                    <\/h3>\n\n                                                                            <div class=\"accordion-faq__panel accordion__panel\" aria-hidden=\"true\">\n                                            <div class=\"accordion-faq__panel-inner accordion__panel-inner txt-14\"><p>The agent is not deactivated. Responsibility passes to the deputy, then to the application owner, then to the line manager. If no successor is named, the case is escalated.<\/p>\n<\/div>\n                                        <\/div>\n                                                                    <\/div>\n                                                            <div class=\"accordion-faq__item accordion__item \">\n                                    <h3 class=\"accordion-faq__trigger-heading accordion__trigger-heading h-24 h-22-m\">How do you prove what an AI agent has done?                                        <button class=\"accordion-faq__trigger accordion__trigger\" type=\"button\"\n                                                aria-expanded=\"false\" aria-label=\"How do you prove what an AI agent has done?\">\n                                            <span class=\"accordion-faq__icon accordion__icon\" aria-hidden=\"true\"><\/span>\n                                        <\/button>\n                                    <\/h3>\n\n                                                                            <div class=\"accordion-faq__panel accordion__panel\" aria-hidden=\"true\">\n                                            <div class=\"accordion-faq__panel-inner accordion__panel-inner txt-14\"><p>The principal, the delegated authorization and the intermediate steps must be logged end to end. Article 12 lists access control and identity management among the events to be logged. The test is whether the chain can be reconstructed in under an hour.<\/p>\n<\/div>\n                                        <\/div>\n                                                                    <\/div>\n                                                            <div class=\"accordion-faq__item accordion__item \">\n                                    <h3 class=\"accordion-faq__trigger-heading accordion__trigger-heading h-24 h-22-m\">What does ECB banking supervision require by October 2026?                                        <button class=\"accordion-faq__trigger accordion__trigger\" type=\"button\"\n                                                aria-expanded=\"false\" aria-label=\"What does ECB banking supervision require by October 2026?\">\n                                            <span class=\"accordion-faq__icon accordion__icon\" aria-hidden=\"true\"><\/span>\n                                        <\/button>\n                                    <\/h3>\n\n                                                                            <div class=\"accordion-faq__panel accordion__panel\" aria-hidden=\"true\">\n                                            <div class=\"accordion-faq__panel-inner accordion__panel-inner txt-14\"><p>An action plan against AI-driven attacks, requested from all significant institutions on July 7, 2026. The focus is on least privilege, logging and human oversight.<\/p>\n<\/div>\n                                        <\/div>\n                                                                    <\/div>\n                                                            <div class=\"accordion-faq__item accordion__item \">\n                                    <h3 class=\"accordion-faq__trigger-heading accordion__trigger-heading h-24 h-22-m\">Do SailPoint and Entra support agent identities?                                        <button class=\"accordion-faq__trigger accordion__trigger\" type=\"button\"\n                                                aria-expanded=\"false\" aria-label=\"Do SailPoint and Entra support agent identities?\">\n                                            <span class=\"accordion-faq__icon accordion__icon\" aria-hidden=\"true\"><\/span>\n                                        <\/button>\n                                    <\/h3>\n\n                                                                            <div class=\"accordion-faq__panel accordion__panel\" aria-hidden=\"true\">\n                                            <div class=\"accordion-faq__panel-inner accordion__panel-inner txt-14\"><p>To different degrees. Since spring 2026, Entra has managed agents as a separate object class with a sponsor. SailPoint has built this only for its cloud suite; IdentityIQ customers build it themselves.<\/p>\n<\/div>\n                                        <\/div>\n                                                                    <\/div>\n                                                            <div class=\"accordion-faq__item accordion__item \">\n                                    <h3 class=\"accordion-faq__trigger-heading accordion__trigger-heading h-24 h-22-m\">What will the AI Act require from December 2027?                                        <button class=\"accordion-faq__trigger accordion__trigger\" type=\"button\"\n                                                aria-expanded=\"false\" aria-label=\"What will the AI Act require from December 2027?\">\n                                            <span class=\"accordion-faq__icon accordion__icon\" aria-hidden=\"true\"><\/span>\n                                        <\/button>\n                                    <\/h3>\n\n                                                                            <div class=\"accordion-faq__panel accordion__panel\" aria-hidden=\"true\">\n                                            <div class=\"accordion-faq__panel-inner accordion__panel-inner txt-14\"><p>From 2 December 2027, the obligations for high-risk AI systems under Annex III apply. For banks and insurers, this covers for example creditworthiness assessment of natural persons and pricing in life and health insurance. As the deployer of a system, whether built in-house or bought, an organization is in any case bound by Articles 26 and 27: human oversight by competent persons, retention of logs and a fundamental rights impact assessment. For their own systems, Articles 12, 14 and 15 also apply: record-keeping, human oversight and robustness. These obligations apply alongside the DORA requirements and do not replace them.<\/p>\n<\/div>\n                                        <\/div>\n                                                                    <\/div>\n                                                            <div class=\"accordion-faq__item accordion__item \">\n                                    <h3 class=\"accordion-faq__trigger-heading accordion__trigger-heading h-24 h-22-m\">How do you recertify an AI agent?                                        <button class=\"accordion-faq__trigger accordion__trigger\" type=\"button\"\n                                                aria-expanded=\"false\" aria-label=\"How do you recertify an AI agent?\">\n                                            <span class=\"accordion-faq__icon accordion__icon\" aria-hidden=\"true\"><\/span>\n                                        <\/button>\n                                    <\/h3>\n\n                                                                            <div class=\"accordion-faq__panel accordion__panel\" aria-hidden=\"true\">\n                                            <div class=\"accordion-faq__panel-inner accordion__panel-inner txt-14\"><p>What is reviewed is the delegated authorization, not the list of rights. Three questions decide: whether the agent is still needed, whether its task catalog matches its actual behavior, and whether its revocation has been rehearsed.<\/p>\n<\/div>\n                                        <\/div>\n                                                                    <\/div>\n                                                    <\/div>\n                    <\/div>\n\n                <\/div>\n            <\/section>\n        \n\n    <section id=\"block_2874629d5312b96072cc81db4cdc8124\"\n             class=\"cta-banner section\"             data-section data-theme=\"light\">\n\n        <div class=\"cta-banner__inner container\">\n            <div class=\"cta-banner__panel\">\n                \n                <div class=\"cta-banner__header\">\n                                            <p class=\"cta-banner__tag title-tag\">Initial call<\/p>\n                    \n                                            <div class=\"cta-banner__text-group\">\n                                                            <h2 class=\"cta-banner__title h-40 h-32-m\">The first step<\/h2>\n                            \n                                                            <div class=\"cta-banner__text txt-16 txt-16-m\">In thirty minutes we show you where your agents and service accounts stand today and what DORA specifically requires of you.<\/div>\n                                                    <\/div>\n                    \n                                                <a href=\"\/en\/#contact\" class=\"btn btn--light btn--arrow\" title=\"Book an initial call\" target=\"_self\">\r\n        Book an initial call    <\/a>\r\n                                        <\/div>\n            <\/div>\n        <\/div>\n    <\/section>\n\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":0,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-1373","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.8 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>White paper: agent identity for banks and insurers | WertFels<\/title>\n<meta name=\"description\" content=\"What DORA requires for service accounts and AI agents, who has to be the owner and how agent identity can be evidenced. White paper as a PDF, no form.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/wertfels.com\/en\/white-paper-agent-identity-banks-insurers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"White paper: agent identity for banks and insurers | WertFels\" \/>\n<meta property=\"og:description\" content=\"What DORA requires for service accounts and AI agents, who has to be the owner and how agent identity can be evidenced. White paper as a PDF, no form.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/wertfels.com\/en\/white-paper-agent-identity-banks-insurers\/\" \/>\n<meta property=\"og:site_name\" content=\"WertFels\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-26T19:57:03+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/wertfels.com\\\/en\\\/white-paper-agent-identity-banks-insurers\\\/\",\"url\":\"https:\\\/\\\/wertfels.com\\\/en\\\/white-paper-agent-identity-banks-insurers\\\/\",\"name\":\"White paper: agent identity for banks and insurers | WertFels\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/wertfels.com\\\/en\\\/#website\"},\"datePublished\":\"2026-09-16T17:56:37+00:00\",\"dateModified\":\"2026-09-26T19:57:03+00:00\",\"description\":\"What DORA requires for service accounts and AI agents, who has to be the owner and how agent identity can be evidenced. White paper as a PDF, no form.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/wertfels.com\\\/en\\\/white-paper-agent-identity-banks-insurers\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/wertfels.com\\\/en\\\/white-paper-agent-identity-banks-insurers\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/wertfels.com\\\/en\\\/white-paper-agent-identity-banks-insurers\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/wertfels.com\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"White paper: agent identity for banks and insurers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/wertfels.com\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/wertfels.com\\\/en\\\/\",\"name\":\"WertFels\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/wertfels.com\\\/en\\\/#organization\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/wertfels.com\\\/en\\\/#organization\",\"name\":\"WertFels GmbH\",\"alternateName\":\"WertFels\",\"url\":\"https:\\\/\\\/wertfels.com\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/wertfels.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/wertfels.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/wertfels-logo-696.png\",\"contentUrl\":\"https:\\\/\\\/wertfels.com\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/wertfels-logo-696.png\",\"width\":696,\"height\":696,\"caption\":\"WertFels GmbH\"},\"image\":{\"@id\":\"https:\\\/\\\/wertfels.com\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/company\\\/wertfels-gmbh\"],\"legalName\":\"WertFels GmbH\",\"description\":\"Beratungshaus f\u00fcr Identity und Access Management. Schwerpunkt sind Banken, Versicherer und weitere regulierte Branchen, dazu Non-Human Identities und agentische KI.\",\"email\":\"info@wertfels.com\",\"telephone\":\"+49 89 244102321\",\"vatID\":\"DE328699375\",\"foundingDate\":\"2020-01-20\",\"address\":{\"@type\":\"PostalAddress\",\"streetAddress\":\"Schellingstra\u00dfe 109a\",\"postalCode\":\"80798\",\"addressLocality\":\"M\u00fcnchen\",\"addressCountry\":\"DE\"},\"identifier\":{\"@type\":\"PropertyValue\",\"name\":\"Handelsregister\",\"value\":\"HRB 31625, Amtsgericht Wiesbaden\"},\"areaServed\":[{\"@type\":\"Country\",\"name\":\"Deutschland\"},{\"@type\":\"Country\",\"name\":\"\u00d6sterreich\"},{\"@type\":\"Country\",\"name\":\"Schweiz\"}],\"knowsAbout\":[\"Identity und Access Management\",\"Identity Governance und Administration\",\"Privileged Access Management\",\"Non-Human Identities\",\"Agentische KI\",\"DORA\",\"NIS2\",\"BAIT und VAIT\"],\"contactPoint\":{\"@type\":\"ContactPoint\",\"contactType\":\"Vertrieb\",\"telephone\":\"+49 89 244102321\",\"email\":\"info@wertfels.com\",\"availableLanguage\":[\"de\",\"en\"],\"areaServed\":[\"DE\",\"AT\",\"CH\"]}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"White paper: agent identity for banks and insurers | WertFels","description":"What DORA requires for service accounts and AI agents, who has to be the owner and how agent identity can be evidenced. White paper as a PDF, no form.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/wertfels.com\/en\/white-paper-agent-identity-banks-insurers\/","og_locale":"en_US","og_type":"article","og_title":"White paper: agent identity for banks and insurers | WertFels","og_description":"What DORA requires for service accounts and AI agents, who has to be the owner and how agent identity can be evidenced. White paper as a PDF, no form.","og_url":"https:\/\/wertfels.com\/en\/white-paper-agent-identity-banks-insurers\/","og_site_name":"WertFels","article_modified_time":"2026-09-26T19:57:03+00:00","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/wertfels.com\/en\/white-paper-agent-identity-banks-insurers\/","url":"https:\/\/wertfels.com\/en\/white-paper-agent-identity-banks-insurers\/","name":"White paper: agent identity for banks and insurers | WertFels","isPartOf":{"@id":"https:\/\/wertfels.com\/en\/#website"},"datePublished":"2026-09-16T17:56:37+00:00","dateModified":"2026-09-26T19:57:03+00:00","description":"What DORA requires for service accounts and AI agents, who has to be the owner and how agent identity can be evidenced. White paper as a PDF, no form.","breadcrumb":{"@id":"https:\/\/wertfels.com\/en\/white-paper-agent-identity-banks-insurers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/wertfels.com\/en\/white-paper-agent-identity-banks-insurers\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/wertfels.com\/en\/white-paper-agent-identity-banks-insurers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/wertfels.com\/en\/"},{"@type":"ListItem","position":2,"name":"White paper: agent identity for banks and insurers"}]},{"@type":"WebSite","@id":"https:\/\/wertfels.com\/en\/#website","url":"https:\/\/wertfels.com\/en\/","name":"WertFels","description":"","publisher":{"@id":"https:\/\/wertfels.com\/en\/#organization"},"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/wertfels.com\/en\/#organization","name":"WertFels GmbH","alternateName":"WertFels","url":"https:\/\/wertfels.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/wertfels.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/wertfels.com\/wp-content\/uploads\/2026\/09\/wertfels-logo-696.png","contentUrl":"https:\/\/wertfels.com\/wp-content\/uploads\/2026\/09\/wertfels-logo-696.png","width":696,"height":696,"caption":"WertFels GmbH"},"image":{"@id":"https:\/\/wertfels.com\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/wertfels-gmbh"],"legalName":"WertFels GmbH","description":"Beratungshaus f\u00fcr Identity und Access Management. Schwerpunkt sind Banken, Versicherer und weitere regulierte Branchen, dazu Non-Human Identities und agentische KI.","email":"info@wertfels.com","telephone":"+49 89 244102321","vatID":"DE328699375","foundingDate":"2020-01-20","address":{"@type":"PostalAddress","streetAddress":"Schellingstra\u00dfe 109a","postalCode":"80798","addressLocality":"M\u00fcnchen","addressCountry":"DE"},"identifier":{"@type":"PropertyValue","name":"Handelsregister","value":"HRB 31625, Amtsgericht Wiesbaden"},"areaServed":[{"@type":"Country","name":"Deutschland"},{"@type":"Country","name":"\u00d6sterreich"},{"@type":"Country","name":"Schweiz"}],"knowsAbout":["Identity und Access Management","Identity Governance und Administration","Privileged Access Management","Non-Human Identities","Agentische KI","DORA","NIS2","BAIT und VAIT"],"contactPoint":{"@type":"ContactPoint","contactType":"Vertrieb","telephone":"+49 89 244102321","email":"info@wertfels.com","availableLanguage":["de","en"],"areaServed":["DE","AT","CH"]}}]}},"_links":{"self":[{"href":"https:\/\/wertfels.com\/en\/wp-json\/wp\/v2\/pages\/1373","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wertfels.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/wertfels.com\/en\/wp-json\/wp\/v2\/types\/page"}],"replies":[{"embeddable":true,"href":"https:\/\/wertfels.com\/en\/wp-json\/wp\/v2\/comments?post=1373"}],"version-history":[{"count":1,"href":"https:\/\/wertfels.com\/en\/wp-json\/wp\/v2\/pages\/1373\/revisions"}],"predecessor-version":[{"id":1397,"href":"https:\/\/wertfels.com\/en\/wp-json\/wp\/v2\/pages\/1373\/revisions\/1397"}],"wp:attachment":[{"href":"https:\/\/wertfels.com\/en\/wp-json\/wp\/v2\/media?parent=1373"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}