Who is allowed to do what in a company’s digital systems? That is the core question of Identity and Access Management (IAM), and it is getting harder to answer as applications work more closely together and AI agents take over tasks. At IAM Circle #18, our lead advisor Patrick Teichmann and Dr. Michael Schläpfer (FortIT) explored what that means. Here are the main ideas:
A working tool is not yet a strategy
Most IAM setups grew step by step: one tool for accounts, another for login, others for privileged access. Each may work well, but together they often sit side by side rather than work together, while the list of identities grows to include partners, devices and AI agents. The better question is not which product to buy, but what does our organization actually need from IAM, and how do we deliver it reliably?
From a pile of tools to a set of services
Our lead advisor, Patrick Teichmann presented the Identity Fabric: not a product you buy, but a framework with three levels.
This keeps the business need independent of any single product. The Identity Service Factory turns the idea into daily practice: IAM offers standard, repeatable services with clear owners and measurable quality, such as a defined way to connect a new application. Existing systems stay in the picture, and improvement happens in small steps, not a multi-year big bang.
Why the business now sets the bar
An observation from the audience added an important twist. IAM used to tell the business what it needed to do. Today, the business is outgrowing that model: many teams embed their own authentication and authorization services directly in their solutions.
For Patrick Teichmann, this strengthens the case for the service view: the central IAM solution needs to address the needs of the different parts of the organization while serving the interests of a central unit in terms of e.g. central governance or similar.
Roles are useful, but a role does not know the situation
Most companies grant access through roles: someone in finance gets the access that comes with that job. Dr. Schläpfer’s point was that a role knows a function, not a situation. It cannot tell whether an employee approving a payment is on a managed device, within her limit or behaving unusually. Covering every case with more roles leads to “role explosion”.
His provocative summary: “Roles will be dead in future, because agents don’t have jobs.” Roles can stay for structure and compliance, but the role should describe the general permission, while the context is checked at the moment of action.
AI agents change the question: who acts on whose behalf?
What changes with AI agents is how they work. An agent can take on a task, bring in other agents and finish in several steps, perhaps existing only for one job and only for seconds. The key idea is delegation. If an assistant organizes a business trip within a budget and hands part of it to a booking agent, each handover should carry narrower limits, and the target system must be able to tell whether a request is still inside the assignment. The principle: delegate a limited assignment with traceable authority, not open-ended access, and make sure that revoking it stops everything handed down from it. The speakers were clear that these are requirements, not a proven solution for any chain of agents.
The hurdles are as much about people as technology
The discussion added a reality check. Rules need owners, applications without suitable interfaces call for IAM to be involved early in procurement, and teams already busy running today’s landscape need capacity to change. The suggestion: start small, in a clearly defined area, and carry the lessons over step by step.
Five practical starting points
No big-bang project is needed. A sensible way in:
- Map your IAM by capability, not by product.
- Define three core services with owners and measurable goals.
- Include AI agents and other non-human identities deliberately.
- Pilot policies and delegation in one small area, including revocation.
- Follow business value and risk, not buzzwords.
The takeaway
The two talks point to the same conclusion: IAM must do more than run tools. The Identity Fabric helps organize what is needed and deliver it as dependable services, and AI agents show why it must stay flexible. Existing roles and systems stay valuable, within a picture that also includes context and controlled delegation.
Future-ready IAM does not just recognize who is acting. It makes clear on whose behalf, within which limits and under whose responsibility.
To explore the framework behind the discussion, take a look at KuppingerCole’s public Identity Fabric reference architecture.
