Traditional IAM architectures begin with a person and a predictable application flow. Autonomous applications select tools and APIs at runtime, cross system boundaries and may delegate work. Giving each component a human-shaped identity does not establish whether its next action should be allowed.
Technical identity, persistent or ephemeral, remains necessary, but it is only one input. Runtime decisions must also consider the requested action, supporting grant or delegation, target resource, current context and possible consequence.
This session shows how APIs become execution contracts: Secure the Chain before execution, Observe and Authorise at relevant transitions, and Break or adapt when conditions change, using short-lived credentials, token exchange, centralised decisions and distributed enforcement.
