AI agent governance is integrating identity security into everyday workflows. As AI agents utilize tools, assign tasks, and interact across multiple applications, enterprises require controls that extend beyond the initial login process. The challenge lies in enabling these controls to function seamlessly across various systems while maintaining the integrity of the business processes supported by AI agents.
Concerns regarding the limitations of individual security platforms surfaced frequently during Okta Inc.’s Oktane event. As AI agents operate across interconnected systems, enterprises encounter issues that go beyond mere access management, as highlighted by Krista Case, principal analyst at theCUBE Research.
“I am eager to observe how this rollout progresses and what feedback we receive from customers, particularly regarding the potential for conflicting insights across various platforms concerning necessary actions,” Case remarked. “For instance, who ultimately holds authoritative power, and where does that authority reside within the technological hierarchy?”
Case, along with co-host Rebecca Knight, engaged in discussions with Okta executives, partners, and customers during theCUBE’s coverage of Okta’s Oktane event, as part of an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming platform. These conversations explored how enterprises are effectively deploying AI agents while maintaining oversight over their access and actions. (* Disclosure below.)
Here’s the complete video keynote analysis featuring Krista Case and Rebecca Knight:
Below are three critical insights from theCUBE’s coverage of Okta’s Oktane event:
Insight #1: AI agent governance requires shared architecture and runtime controls.
AI agents operate across applications and security platforms, making it crucial for these systems to interconnect effectively to provide consistent protection. The Blueprint Alliance aims to unite vendors around a reference architecture designed to assist customers in securing that environment, according to Charlotte Wylie, senior vice president and deputy chief security officer at Okta.
“Rather than attempting to resolve these issues in isolation, there is a collective recognition that we must unite as an industry to address these challenges rapidly,” Wylie explained. “We aspire to furnish an architecture and a referenceable framework [for] how to use the technologies we collectively provide to secure the entire agentic stack.”
Shared architecture must also incorporate points where controls can manage attempted actions. Okta’s recent foray into the runtime environment, facilitated by its Agent Gateway, enhances the identity provider’s capabilities from merely granting access to evaluating the activities agents wish to undertake, as noted by Ric Smith, president of products and technology at Okta.
“This marks a significant transition for Okta,” Smith shared with theCUBE. “Previously, we had not been positioned inline; now, moving in this direction enables us to make more nuanced decisions regarding what we authorize.”
This architectural challenge presents practical considerations within Okta. Dex provides employees with access to specialized agents without the need for multiple interfaces, according to Jenna Cline, senior vice president of technology, data, and intelligence at Okta.
“Dex can summon the appropriate sub-agent which is specifically scoped to operate on certain tasks, ensuring both security and efficiency by performing a single function exceptionally well,” Cline explained. “Dex’s capabilities extend across various domains, including support teams and the expense department.”
Here’s theCUBE’s complete video interview featuring Jenna Cline:
Insight #2: Securing AI agents requires cooperation beyond any single vendor.
Effective AI agent governance necessitates that access control decisions are cohesive across systems. Okta, in collaboration with AgileBits Inc., known as 1Password, employs shared identity standards to maintain an agent’s confirmed identity and authorization context. The 1Password Credential Broker provisions secrets without disclosing them to the agent or the underlying model, as explained by Nancy Wang, chief technology officer at 1Password.
“Just as you would verify the performance of an intern before advancing them to the next project, the same principle applies to agents,” Wang stated in her discussion with theCUBE. “You want to ensure that an agent has completed its prior task correctly and with the appropriate permissions before allowing it to proceed.”
This collaborative approach is essential, particularly when agent behavior necessitates intervention. ServiceNow Inc. is aligning agents with the business processes they support and is collaborating with Okta on agent identities and session tokens. These connections facilitate informed decisions regarding when and how to contain an agent, according to Bhakti Pitre, vice president of AI platform security product at ServiceNow.
“It is imperative that industry participants come together and cultivate collaborative relationships,” she urged. “To scale AI technology effectively and democratize access, all vendors must actively contribute and collaborate.”
Here’s theCUBE’s complete video interview with Nancy Wang:
Insight #3: Simpler infrastructure and established governance provide a foundation for AI agents.
The Professional Golfers’ Association of America leverages Okta and Auth0 within a framework that has eliminated traditional infrastructure layers, such as data centers and corporate networks. These strategic decisions enable a focus on technology that better serves members and customers, as articulated by Kevin Scott, chief technology officer of the PGA of America.
“Our team is relatively small and efficient,” he explained to theCUBE. “Rather than allocating a significant portion of our technology budget to system administration, we prioritize what truly benefits our customers.”
At Vanderbilt University, the emphasis is on applying established governance processes to AI agent identities. The university utilizes OneVU, powered by Okta, for single sign-on and is evaluating how institutional oversight should integrate emerging identity types, stated Shane Callahan, chief information officer of Vanderbilt.
“We approach AI as a novel entity, yet fundamentally, we are still managing identity data within a different technological context,” he noted. “There is no need to reinvent governance processes; if you already have a functioning governance model and technology intake program, leverage that.”
Here’s theCUBE’s complete video interview featuring Kevin Scott:
For more insights from theCUBE’s coverage of Okta’s Oktane event, view our complete video playlist:
https://www.youtube.com/watch?v=videoseries
(* Disclosure: TheCUBE is a paid media partner for Okta’s Oktane event. Sponsors of theCUBE’s event coverage do not exert editorial control over the content produced by theCUBE or SiliconANGLE.)