What happened

Okta presented a new approach to AI cybersecurity that centres on giving each AI agent its own identity and tightly scoped authority. Harish Peri, senior vice-president and general manager of AI security at Okta, told theCUBE Research’s Krista Case that enterprises must answer four questions: where the agents are, what they can do, what they are doing and how to respond. He warned that the biggest risk is not hacking but agents acting outside the user’s original intent. Peri said the risk comes from a misaligned agent without any bad intention taking an action that was never intended by the original user.

Why it matters

When an AI agent simply impersonates a user, it becomes little more than an overpriced robotic process automation tool. Overloading a service account is a quick fix that breaks down as deployments grow, Peri explained. Without a clear chain of custody, organisations cannot prove what an agent did when an error occurs. Peri stressed that enterprises need to be able to explain and prove the series of actions an agent took, and to find that information in logs as a single unbroken chain. By assigning a unique identity to each agent and enforcing delegation with down-scoping, the authority travels safely across applications such as SAP, accounts payable and CRM systems. This ensures that an agent invoked by a frontline employee never exceeds that employee’s maximum permissions, even if the agent could, in theory, act on behalf of a manager.

What this means for enterprise IT teams

IT teams will need to extend identity-management platforms to cover AI agents, not just human users. Implementations must capture an unbroken audit log for every agent action, enabling rapid forensic analysis if something goes wrong. Delegated, down-scoped permissions reduce the attack surface and simplify revocation when agents are decommissioned. Peri cautioned that shortcuts, such as using generic service accounts for multiple agents, become costly to unwind once an organisation runs more than ten or fifteen agents with access to enterprise applications. Teams should therefore adopt a foundation that gives each agent its own identity and avoids shortcuts on the foundations, even if it feels like innovation in the short term.

In the words of Harish Peri, senior vice president and general manager of AI security at Okta: "If something does go wrong, are you able to explain and prove the series of actions that an agent took?"

The bottom line

Okta’s guidance pushes identity providers into runtime enforcement for AI agents. Distinct identities, scoped delegation and comprehensive logging are essential to prevent rogue behaviour and maintain auditability. Enterprises that adopt these controls will be better positioned to manage AI-driven processes securely and meet regulatory expectations.

Sources

  • siliconangle.com