Jul 28, 2026 · 43 min · 10 segments
Which AI agents can access what? Are those permissions even right? And can you stop a compromised agent mid-action? Okta's Dan Cinnamon says most enterprises can't answer any of the three. Dan…
We're thinking of persistent employee that needs access to particular systems with permissions and roles.
When our old school human era identity management meets these machine driven, high speed kind of agents, what do you think is the first thing that structurally breaks down?
I think the biggest one from my perspective is the, well, it kind of permeates into a number of areas, but the biggest one is attribution, right? So if I, Dan, send them and ask my agent, whatever that is, it doesn't matter what it is, to do something on my behalf, ideally what would happen is that all layers of the stack, wherever that terminates, would be aware that it's not me doing the thing.
And that is something that we haven't really... haven't really done fully, right? Whether, I mean, even if you count, I'll set this aside for a moment, but I mean, a lot of stuff is still like when you get into the machine part of the stack, heck, we're still using API keys, right? Where there's no human identity at all there, right? You've got like service accounts and things like that, where that whole like attribution of the user permissions is completely lost, right? Like that's completely gone.
Now, even if you take like the most, you know, well-designed and modern API that's following proper OAuth standards and things like that.
We are in a better position there, for sure, because at least there's, like, a machine identity and a user identity.
right? Like, we know that there's some inbound machine identity that we did consent for, but we don't really – there isn't really a distinction that says – This is an agent that is non-deterministic.
And there's not really a way of saying, in this instance, we want to pair it back, right? Like a lot of the OAuth tokens that you would get today are kind of fully fledged on behalf of that user, right? And so there hasn't been a lot of downscoping so that when an agent tries to use that OAuth token, It's actually more finely scoped than if the human really is themselves.
And I think that kind of getting back to what I was getting into earlier is if you don't have attribution, you can't cap the agent's activities, right? It's very easy then for the agent to make a mistake and do something that the human shouldn't be doing.
if you don't have that user context, right? So having that attribution not only makes sure that we know who did what, it's also providing the foundation for being able to cap the access that the agent has.
Over the last, well, in the short time we've had it, it's done a great job of maturing, right? Like if you look at the very first release, there's a lot of concerns that we have from the security perspective.
Some of my colleagues in the industry kind of jumped in and helped guide that working group.
We're thinking of persistent employee that needs access to particular systems with permissions and roles.
When our old school human era identity management meets these machine driven, high speed kind of agents, what do you think is the first thing that structurally breaks down?
I think the biggest one from my perspective is the, well, it kind of permeates into a number of areas, but the biggest one is attribution, right? So if I, Dan, send them and ask my agent, whatever that is, it doesn't matter what it is, to do something on my behalf, ideally what would happen is that all layers of the stack, wherever that terminates, would be aware that it's not me doing the thing.
And that is something that we haven't really... haven't really done fully, right? Whether, I mean, even if you count, I'll set this aside for a moment, but I mean, a lot of stuff is still like when you get into the machine part of the stack, heck, we're still using API keys, right? Where there's no human identity at all there, right? You've got like service accounts and things like that, where that whole like attribution of the user permissions is completely lost, right? Like that's completely gone.
Now, even if you take like the most, you know, well-designed and modern API that's following proper OAuth standards and things like that.
We are in a better position there, for sure, because at least there's, like, a machine identity and a user identity.
right? Like, we know that there's some inbound machine identity that we did consent for, but we don't really – there isn't really a distinction that says – This is an agent that is non-deterministic.
And there's not really a way of saying, in this instance, we want to pair it back, right? Like a lot of the OAuth tokens that you would get today are kind of fully fledged on behalf of that user, right? And so there hasn't been a lot of downscoping so that when an agent tries to use that OAuth token, It's actually more finely scoped than if the human really is themselves.
And I think that kind of getting back to what I was getting into earlier is if you don't have attribution, you can't cap the agent's activities, right? It's very easy then for the agent to make a mistake and do something that the human shouldn't be doing.
if you don't have that user context, right? So having that attribution not only makes sure that we know who did what, it's also providing the foundation for being able to cap the access that the agent has.
Over the last, well, in the short time we've had it, it's done a great job of maturing, right? Like if you look at the very first release, there's a lot of concerns that we have from the security perspective.
Some of my colleagues in the industry kind of jumped in and helped guide that working group.
The rest of this transcript — segmented and speaker-labeled, so you land on the exact moment something was said
Search every transcript — by keyword, by phrase, or by meaning, across every show Radar indexes
Trends — what is surging across podcasts, measured against its own baseline
Alerts — when a name you follow appears in a newly indexed episode
No account is needed to search Radar.
