Identity and access, explained simply
Your identity is your badge, and access is the list of doors it opens. People are not the only ones with badges.
The big idea
Think of a big office building. In the old days, getting past the front desk was the hard part: once you were inside, you could wander into almost any room. Today most doors have a badge reader, and each one asks two questions: who are you, and are you allowed in this room? Your identity is your badge. Access is the list of doors it opens.
In the old days, once Ana was past the front desk she could walk into any room. So could anyone else who got in.
Compare the old days with today.
That works well, until someone steals a badge. So the badge has to be hard to copy (a code on your phone is better than a password alone, and a security key is better still), and someone has to notice when a badge is used at 3am from another country.
Ana's badge opens the front hall, her office and the post room. Nothing else, because her job needs nothing else.
Pick one to compare.
People are not the only ones with badges. Computer programs that talk to each other carry them too, called keys, tokens and certificates. There are far more of these than there are people, and many were made for a job years ago, never given an owner and never taken back. A badge nobody owns is a badge nobody notices going missing.
AI helpers are the newest badge holders. If one can read your email and change records, it needs what any member of staff needs: someone responsible for it, only the doors it really needs, and a record of where it went.
Ana's badge opens the front hall, her office and the post room. Nothing else, because her job needs nothing else.
Pick a badge holder, in the list or in the picture.
Words you will meet
- Identity: who or what is asking. A person, a program or an AI agent.
- Authentication: proving you are who you say you are, with a password, a code on your phone or a security key.
- Phishing-resistant: a way of signing in that a fake website cannot trick you into handing over.
- Non-human identity: a badge held by a program, not a person: service accounts, API keys, tokens and certificates.
- Least privilege: give each badge only the doors it needs, and nothing extra.
- Access review: someone regularly checks who still holds which badges, and takes back the ones nobody needs.
The field notes, in plain words
- Governing AI agents: keep the record, expire the access
Give every AI helper a named person who answers for it, and keys that stop working as soon as each job is done.
- Identity is the perimeter, so what guards identity?
The wall around the office matters less now and the badge matters more, so look after the badges: hard to copy, each with an owner, and watched once used.
- Is an AI agent just another non-human identity?
Whether an AI helper counts as its own kind of account depends on one thing: does it carry a badge of its own, or borrow yours?
- Machine identities outnumber people; few organisations can list them
Computer programs hold far more passwords and keys than people do, and most organisations cannot list them or say who looks after each one.
Ready for more? Identity and access: where things stand
Personal work and my own view, not my employer's. Sources are public.