Identity and access
Identity has become the control point: access is decided by who or what is asking, not where it sits. The hard parts now are the accounts nobody owns, including service accounts, API keys and the identities AI agents use, and keeping access in step with how people actually move through an organisation.
New to this? The simple version
Field notes
- Governing AI agents: keep the record, expire the access
Identity governance, access reviews and privileged access management can all cope with AI agents, once each agent is split into a lasting record with a human sponsor and access that is granted for a task and then expires. What that looks like in practice, and why the borrowed login defeats all of it.
- Identity is the perimeter, so what guards identity?
Once identity decides access, stolen credentials and forgotten accounts become the way in. Guarding identity means phishing-resistant sign-in, owners for every account, and watching sessions, not only logins.
- Is an AI agent just another non-human identity?
An AI agent is a non-human identity only when it has credentials of its own. If it carries a person's delegated authority or borrows their login, it is something else, and the route decides whether PAM, access reviews and IGA can see it.
- Machine identities outnumber people; few organisations can list them
Service accounts, API keys, tokens and certificates now far outnumber staff, and most have no owner and no end date. Start with an inventory that names an owner for each, then shorten how long their secrets live.
Personal work and my own view, not my employer's. Sources are public.