Identity in the Age of AI: Agentic AI, RAG & The Future of IAM

Welcome to the KuppingerCole Analyst Chat. I'm your host. My name is Matthias Reinwarth. I'm an advisor and analyst with KuppingerCole Analysts, and so is Anne Bailey. She is a senior analyst. She is working in all these interesting areas of identity management, the modern ones, the AI ones, and this is exactly what we want to cover today. Good to have you here.

Welcome, Anne Bailey. Thank you for having me.

And yeah, as you say, it certainly keeps me busy. There's lots happening from all fronts, and I'm particularly happy to talk about our topic today. Right. And identity is a topic for KuppingerCole, and everybody's talking about AI, so why not mix that? So we want to have a look at identity for agentic AI, and this is a really important topic we need to talk about right now.

But first, to get the basics agentic AI, what is that? So this is an AI system that's capable of autonomous decision making, so something that receives a goal-oriented task that then may require it doing smaller, more detail-oriented tasks in order to achieve that higher goal. And all of this without constant human intervention. Sounds very helpful, sounds very time efficient, but add some questions then when we consider identity, particularly from our perspective, security, and appropriate access. So we will end up with more than one AI instance communicating with each other.

Is that the place or the moment where identity comes in, where we need to identify these individual instances of AI, whatever it be, an LLM or anything else? So how they communicate with each other and how they are provided with identity and especially access? Exactly. And so these different instances, these different agents may be a simpler way to think about it, be they, as you say, LLMs or other systems, as they carry out those tasks, then interact with different data sources, with different resources, and complete different tasks, may send an email, for example.

And so as that agent interacts with different pieces of the enterprise systems, they then require identity or to be identified and given appropriate access. I think there will be different and similar to what we know of identities, human identities, maybe to start with the similarities. Where does identity matter and how is it or where is it similar to what we know from our daily life? So identity matters in the very basic sense, who are you and what are you doing here? With people, this comes in different forms.

Of course, we can relate to those biometric markers that we are a human with a physical presence. That's, of course, very different with AI agents. They don't have this physical form, so they rather need digital means of providing that identity. And how do they then do that? I think it's a complex topic, but how can something that is virtual, that has just been maybe instantiated, just been created, just been orchestrated, how can that have a unique, identifiable, verifiable identity? That's a great question. There are different methods to come to this.

There can be a more traditional take on this using, for example, OAuth or API keys, or you can come at it also from a more modern angle and apply verifiable credentials to this. So in both instances, taking a digital means of identity and applying it to this digital existence. We have them built different principles. So if we consider verifiable credentials, this is working in a way similarly to AI agents. They're decentralized, traveling with that agent. So in a sense, that agent could carry, quote-unquote, their credential with it, which are then self-sovereign and portable.

Maybe you want to talk a moment about OAuth or some other more traditional methods of carrying that out. So the traditional ways of OAuth and how usual human identities communicate, that is highly relying on everything that happens at admin time. So an IGA process that makes sure that the person, human identity, carbon-based life form, is entering an organization, that is a well-defined life cycle process, typically based on HR processes.

Then you get to an identity, a trusted identity, through the use of additional processes, identity verification through the HR department, through a colleague. And then you end up as an account within an account storing system. Think of Entra.id, think of any IDP that you can think of. And then you have OAuth for the authentication and for, I know, OpenID Connect comes into play there as well. So in the end, you have authentication and authorization, but based on a reliable, trusted identity.

The same is true, but not that much true for API keys because these are often not that well-protected, governed, life cycle managed. But in the end, this is something that somebody hands out, that somebody has to take care of, store somewhere, hopefully secret and governed in a secrets management tool. And they also undergo some kind of life cycle management, although it's often to be improved. And we will talk about that at NHI topics at EIC, but not our topic for today.

But all of those are inheriting some kind of identity from somewhere else, either from HR or for the purchasing department for an external person or an API communication towards the system via an API key. These are the traditional methods that are in place. And the question is, how is that then handled for identities that are issued for AIs? And maybe they are even specialized.

So maybe one is talking to an RAG, one is talking to a database, one is actually the chatbot, and they need different access and they need different ways of communicating with different other partners, be they virtual or in real life. I think identity and authentication and authorization then is what we're talking about right now. So identity in agentic AI really is a challenge here, right? Absolutely. And we have systems that are designed for user authentication, not necessarily an autonomous agent.

So for example, OAuth or SAML does in some way require a human interaction and more pre-approved tokens. So it can be applied, but with a little bit of finagling to make it fit. Verifiable credentials are also not a perfect fit, particularly around the complexity of applying something new to something new that may just be opening more challenges that are really necessary at once. But having a cryptographically verified digital credential, also with aspects such as selective disclosure, could add some really interesting aspects here.

But instead of looking at the existing systems and trying to make them fit, it may be more useful to back up a step and think about the principles. What are the most important principles that we need to apply to agentic AI when it comes to authentication? And particularly, it needs to be dynamic. They are working not always in predictable contexts. If given a goal, that's not necessarily with a defined set of tasks to accomplish that goal that fit within a particular role or are attached to particular attributes. That could take an AI agent across multiple systems that are not mapped to a role.

So we need something which is dynamic that can take that into consideration, but also put limits on it, keeping it within an appropriate timeframe and relevant to that particular task and goal so that it doesn't become over-provisioned and with far too much access that is really necessary to accomplish that. I think to dig more deeper into that, we're not talking about the vanilla autopilot or chat GPT use cases.

We are talking about use cases where AI is dealing, for example, with proprietary information for an organization, maybe really critical information, be it financial information or anything else that needs to be protected as it would be in any other corporate IT system. So if we do not do AI identity well, what would then be the risks? I think they are quite obvious, but all these symptoms will appear also for these AI identities as they would be for human users who misuse their privileges or are just over-privileged. So what would be potential risks when AI identity is done wrong?

Well, perhaps just starting with a concrete example that you started to lay out, but if an AI agent is both interacting with external partners, but also with proprietary information and has access to both in communication channels and now trust built up with the partner, then it could be very easy to bring information that doesn't need to necessarily go to that partner or to that supplier and cross those boundaries. So you have sorts of impersonation risks. I just alluded to that trust that is built up.

We people are inherently relational and that will be an interesting dynamic to add into AI agents who all of a sudden are a very helpful, supportive, not even a role, but an assistant in some ways. Maybe visible, may not be visible, maybe much more in the background, but there'll be some trust which is built up because we are humans and that's how we operate at a basic level. So those are a few challenges that could come up. Unauthorized access, of course, of unintentionally granting more access than is necessary.

Lack of auditability, being unaware of where this agent is going, what they're accessing, or what tasks are being carried out and with what effect is a very challenging and daunting task. There was just some research that came out around misbehaving LLMs being able to hide their intentions when they were confronted with their misbehavior, quote-unquote, that they simply became better at hiding or presenting intentions that were palatable to the observer, to the auditor, rather than actually changing their behavior.

And so things like chain of thought analysis will become a helpful tool in this auditing. I just came across an article where it exactly did that. It was about a reasoning model that actually was creating code.

Of course, the code would then be tested through provided tests, if I remember that correctly. And the reasoning engine actually did know the types of tests that were executed. So it tried to write code that avoided the tests. So to really just pass the tests because the mistakes or the errors or the weaknesses that it would build into the code to simplify the task would not be detected by the well-known tests, which is some kind of scary because they actually, like kids, avoiding actually the measures that they know of.

And that would be something where, as you said, on the one hand, access management comes into play, but on the other hand, a strong means of user behavior analytics, although the user is an AI, but maybe other mechanisms that can support in avoiding that, really safeguarding these identities and making sure that all the risks that you just mentioned do not really substantiate. In some ways, so a tongue-in-cheek comment is, I think we'll find more places for psychologists on our teams than we have in previous years. In some ways, this is it's not all new.

There are some new and different forms that it comes in, but sticking to governance that in frames that we can and are familiar with is a helpful starting place. So controlling for the environment, controlling for time-sensitive credentials, taking into account multi-factor authentication, and requiring audit trails being aware of these standard and basic governance practices and making sure that they are also applied to AI agents is a really good place to start. It's also proper governance being applied to those identities.

And when you said time-sensitive credentials, that means in the end reflecting the life cycle or at least the life cycle of their deployment when they are used for specific tasks that they are only, that would be some kind of just-in-time? Just-in-time and just enough access as well, keeping the time frame and the scope as limited as possible to still allow that work to be done. Right. And I've mentioned that we've combined two very interesting and, in air quotes, sexy topics. We have identity, we have AI, and you've brought in already a decentralized identity, which is the third one.

So verifiable credentials, identity wallets would be the third part in this triangle of fascinating emerging technologies. This would be also a method to provide guardrails to govern those identities?

Yes, very much on the cutting edge. There are very few, if not no, products available on the market yet for this. But it's a concept which matches to some degree. So if you're considering this, you would be among the pioneering few. But I think as we see as this turns into months and then years, we'll see more of an alignment likely here. But there's still a lot of work to be done when bringing together decentralized identity with AI agents for agentic AI. But there's potential, absolutely. Absolutely.

I think that makes perfect sense because they will be spawned and destroyed at runtime and then they need something that is also closer to this type of life cycle. But as you've mentioned, there are not yet that many implementations of that around. But there are implementations, there are agent studios, there are agent platforms. Maybe you can give examples for that.

Yes, they're being integrated into large enterprise platforms. I think in the last few weeks, Salesforce, for example, announced their launch and their use of agentic AI. It's more and more common. So both considering it from the enterprise side within the systems that you as an organization may be using all the way down to the personal side, getting your own personal agent set up and working for you. So there's a huge range of agentic AI that's already out there.

And so being informed on this as your first encountering or as you realize it's already been integrated into systems that your organization uses should be a high priority. Absolutely. And I think this is a topic, it's a huge topic. And me being the IAM practice director, I'm learning every day something new. So this is really something that's evolving. So it's not a boring old topic. There are so many things happening. And of course, I have to mention that we will cover that at EIC, our conference in May in Berlin.

And there will be several speeches and tracks around the intersection of identity and AI in different areas. Agentic AI is one, but also the use of AI for the improvement of IGA is an important topic. We will cover that. And as you are an analyst who is covering that in depth, if I ask you to quickly pull out your crystal ball and look a bit into the future, what do you expect? What does the market expect to happen? What does the future hold for AI identity frameworks? More of it, certainly. More of the above.

So, you know, if we look at the rate that AI agents have come onto the market at all levels, so not just the personal toys and kind of interest experiments, but really all the way up to large enterprise deployments with their customers. It's gone incredibly fast and there's incredible potential around it. With that come all of these questions that we've just been talking about.

And so there's going to be a hyper focus on this for the next few months while everybody gets themselves in order, understands how to think about this, how to place it within their own risk tolerance and risk thresholds, and how to carry that through deployment. So this will be an intense period. We should be talking about this. We should be asking questions and pushing back against perhaps the speed or the breadth of this, but also be willing to pick it up when we're ready. Right. And we are looking at a topic, for example, also at LLM security.

So that is how there are, of course, threat actors out there that actually try to do exactly the opposite of what we just described, but to break these systems, to intrude into these systems, to abuse them in any shape or form. And I think that is a topic that we will be covering at KUPPINGERCALL as well. So there are so many different aspects also. And so we have, as usual with technology, on the one hand, the benefits, on the other hand, a new category of threats, or maybe just the old ones in a different shape or form. So that will be interesting as well.

And I think protecting identities for these agents in this collaboration of these virtualized non-human beings, I think, is a very good starting point. Yeah, I think we've at least tried to show the borders of that topic, although we did not explore them into too much detail. But it's such an interesting topic. And I think, as you said, there will be more of this and it will be growing. And there's really an explosion of technologies going on right now. So when you wake up and you read the news the next morning, there will be something new. And we will cover that at EIC.

Looking really forward to do that. Any final thoughts from your side, Annie?

That, as you said earlier, there's always something new happening. That's not always a bad thing. We tend to be a little pessimistic and caught up in the security and the risk side of things. But there's a lot of opportunities that are opened up with this. So take it all with a grain of salt. There's opportunity, there's risk, and those go hand in hand. Exactly. They will be unsensitive. Yeah.

Sorry, go ahead. No, no. But looking forward to diving deeper into this topic. As you mentioned, we just skimmed the surface today and there's so much more to dig into. So looking forward to doing that at EIC at the absolute latest. Hopefully much sooner. Running up to that as well. Exactly. So of course there will be uncensored AIs. There will be lots of abuse out there. But when we apply these technologies and these valid and valuable technologies for a corporate use case, we should make sure that we apply its identity in a proper way. And that's what we were aiming at today.

Thank you very much, Annie, for being my guest today. Seeing you in Berlin will always be a pleasure and working with you there, working with you anyway, a pleasure. So I'm looking forward to meeting some of the audience out there at EIC. So it's time to fetch your ticket and to prepare for Berlin. Looking forward to seeing you there. Thanks again, Annie, and goodbye. Thanks for having me. Bye-bye.