The Laws of AIdentity

So, the title of my talk today is about the Laws of Identity, and that is inspired by Kim Cameron's Laws of AIdentity, inspired by Kim Cameron's original Laws of Identity. So, in 2026, last year we were talking about AI agents, and it really was coming, we were using them, they weren't really entering the business, but at this point, they're no longer demos, they're in production, they're in our lives. Things that AI are already doing, they're booking your flights, they're checking your email, they're summarizing your meetings, they're negotiating your insurance policy.

So, we're using these agents every day, and really, there isn't even a common language or understanding, even among the experts here, that's the one thing that's very clear, of how to talk about securing agents and whether we're secure, the terminology, the technology, the gaps, what we're missing.

So, we're not on the verge of the change, we're actually inside it right now, we're all living it, and I think many of us feel like we got hit by a big wave and we're in the middle of that wave, we're not sure when it's going to beat us on the bottom of the ocean or when we're going to pop back up again, and that's kind of the way I feel, for sure. So, this is just kind of a cathartic way to share some of that inner angst and some feelings and thoughts and lessons learned and throw it out there to start the discussion.

So, in the future, well, the future is here, in the very, very near future, you can't even say the future anymore, a five-year plan is really something that is kind of not worth the paper it's written on these days, but in the future, the AI agents are going to be a part of our lives. They're going to help us do things that we were not able to do or didn't have the time or only the wealthy had personal assistance and teams that could handle these things for them.

Now, you have AI assistance or digital assistance that everyone can use. So, example, retirees working and negotiating their benefits to make sure they're getting the best healthcare possible. Someone working on their studies, cutting out all the grunt work. I know personally I spent too many nights collating data manually from gene databases that if I would have had an AI agent, I mean, I probably would have had a lot more time at the bars, probably not spent very well, but I would have had a lot more free time.

And as an owner of a small business, taking out the need for expenses like an accountant or other things where you're trying to start a business and the barrier to entry might be too high because of the expertise that you require, which an AI agent could easily solve. So, that all sounds great, but the challenge right now is we don't trust them, and we shouldn't. Does anyone here say that we've got it all worked out and they trust the agents that they've implemented in their enterprise completely? They think they're locked down, there's no problems there at all? Anybody?

I'd say if I asked the opposite, probably everyone would raise their hand. So, we don't have the means to control them. The systems and logging and authorization and governance and onboarding isn't there for these agents.

So, it would be foolish to trust them. It doesn't mean we don't need them. It doesn't mean that the sea level isn't pushing them hard and fast due to the benefits, the cost-cutting, getting things faster to market.

So, four questions, though, that unless you can reliably answer these, you can't really trust agents and you can't feel safe. And right now there's a big gap. Who actually acted? In the old world, if I'm a human and I hit the button in the software that says delete database.

Oh, Andre. The famous. What was that? Is that Ebeneezer Scrooge? But in the old world, it was very clear.

Button, hard-coded action, human intent. If you hit the delete database button, we know who did it and we know what you were intending to do. In the new world, and then even with non-human identities, they have hard-coded instructions. They can do what they can do. It's programmatic.

Now, with agents, human, agent, I need to free up some disk space. Human intent, agent, agent has tools.

Oh, I gave my agent 500 tools. One of those tools is delete database.

Oh, I have Patrick's token. Patrick can delete the database and that is the largest file in his system. Patrick's really going to be happy. So you have a huge gap of who did it, why were they allowed to do it, why did it happen, how did they get to the point where that was the action, the intent that was arrived upon after looking at data, tools, context, everything else, and can you prove it?

Because right now, the auditing and logging systems, if an agent uses my token, the agent's going to tell the boss, Patrick deleted the database, and the rest of it's just my cover story, and we'll see if they believe it or not. So behind every action, it looks like one agent, a chain of six distinct roles. I'm going to have to turn to this to remember it. So there's the principle, which is there's a human involved somewhere. Even in an autonomous agent that's running like OpenClaw on a heartbeat schedule, some human was involved somewhere, I hope. OpenClaw didn't install OpenClaw.

But there's a chain all the way back to a human. There's the model, which is the brains that formulated the plan, and hopefully you have a smart brain or else you're going to have a lot of dumb plans, and they're getting smarter all the time. There's the policy point. So in that chain, some thing authorized that action.

It said, oh, okay, you're allowed to do that. Now, did it say you're allowed to do that just because Patrick gave you his token and all the tools and it's something that you have the capability to do? Or did it allow that because that was the right thing to do under the conditions, the risks, the context? And then you have the vault. And this is the biggest mistake of all. Something holds the credential to allow it to touch a system and perform work.

Your Active Directory user, your Microsoft 365 account, most of those APIs do not support modern on behalf of tokens, so it's going to have the user token. And I hope to God you're not giving your agents your token because if your token can do everything, it can email everybody, all of your personal files, it can delete your databases, and you hope it does one thing, then hoping it does one thing when giving it a token that can do everything is suicidal.

So really, the vault should hold the tokens. And then the most important role, I think, maybe I'm vendor biased, is the executor. The executor is the one that knows how to perform that action, how to delete a database, how to create an SAP cloud user. It's the one that knows how to execute, and it's the one that has to have the credential or have access to the credential, know how to do it, and it has to be told to execute.

So it's very important later, it's the only one that has all the pieces of information that can put together the chain because after that, this downstream system just sees the user. It doesn't know what happened. And then you have the downstream, which just sees, you know, Patrick deleted a database, and it doesn't know anything about what happened upstream. So you have a split principle. You don't have a single principle like in a human scenario. So that's probably the most important thing. And right now, if you look at the logs, we say, oh, logging's going to save us.

But if you look at the logs, you're going to see, you know, transfer funds, the agent did it maybe, but most likely if the agent was acting as you, it would look like you did it, the amount and the status, when what we need to see is we need to see transfer funds. The principle was a human. The agent didn't want to transfer money. The agent doesn't care. It's doing something on behalf of a human for their benefit. So it was Sarah.

Her agent did it, authorized by, hopefully traceable back to a policy, that your policy decision point used this policy, and that was the one that validated it was allowed, and via a delegation. So one important thing is if you have a bunch of agents, how did you authorize that agent to act on your behalf?

There has to be this relationship graph that this agent has been authorized by you to use these capabilities, and if it needs to use your token, that it won't get the token, but it can call the executor and say, hey, they want me to do this, unvault it, don't let me have the token, but give me the results back. We'll talk about that later. And then a receipt.

All of this, if you're going to have such an obscure, you know, whodunit, like in Agatha Christie, where it could have been anybody, it could have been everybody sometimes, then you need to have a receipt in the end that is cryptographically hashed and, you know, chained so that you have proof of what happened and all the information to put it back together to decide who deleted the CRM database and lost us millions of dollars, basically. So the good thing is we have been here before, and some of us remember it quite well. Some of us had the pleasure of meeting Kim Cameron.

Some of us had the pleasure of being friends with Kim Cameron. I know some of you were friends with Kim Cameron. I met Kim Cameron a couple times. I was very impressed. He had a certain gravitas to him, a professorial style, but he was a very nice guy, very cheery. So in 2005, the Internet was the Wild West, and there was some SSO out there, Kinda, SiteMinder, Oblix, all these weird things, all proprietary, all very clunky. Everybody was talking about different things and proposing different standards, WS-Fed, WS-Trust, well, maybe even before that. And phishing was exploding.

Users were clicking on funny dancing pig emails and having their computers taken over. It was a madhouse. It was good for us. We got paid, and we all got jobs, which was very nice. But Kim Cameron, who was Microsoft's chief architect of identity, he, instead of just making a product, during the course of that, he came up with a set of laws, and not laws like, I'm the lawgiver, or he didn't see a burning bush, but a set of principles that could start the conversation so everybody would be on the same page or at least talking the same language. And his law is a very famous paper.

I recommend you read it. They were revolutionary at the time.

I mean, you know, things like user control and consent. I know Eve's probably in here somewhere. That was something that people were not even thinking about or very few people were thinking about at that time.

Consent, you know, why would you ask the user for consent? Justifiable parties, human integration. So these laws were really what led to an explosion of discussions and new technologies that effectively solved the problems. It solved authentication many of you consider solved. And that's a good thing. It's not this clunky, mysterious thing with proprietary standards. So all these things came out of that, the laws that started that discussion and started people thinking about that, and we're all the benefactors of that today.

We live in a much cleaner, neater, easier world where we're not doing crazy things like editing INI files and, you know, XML and all this other stuff that was not fun. But we're here again, and some of us it's our first time, and some of us it's our second time. I don't know if there's any third timers in here, but it's at least some second timers in here.

So 2024, AI exploded. I mean, many of us saw it instantly.

I mean, when ChatGPT came out, I'm like, I wonder if this thing can write code. And I did a little experiment.

I said, make me an Azure web job that monitors for risky group membership changes and send an email, just something stupid. And then I hired on guru.com a consultant to see if it worked. And $80 later, it worked. And I was like, oh, shit. As a vendor, because it was clunky, but you could make it work. It could make real stuff that people wanted to buy in minutes. So that really set the ball rolling. I know some of us have been in panic mode since then, not living our lives, but that's okay. But we have the benefit of other people, visionaries like Martin. You all know Martin.

I don't need to introduce Martin. But Martin gave us Identity Fabric, which is a very commonly used word now, like microservices for identity, API-based, standards-based communication, modular, so you can plug and play and talk to each other. He also recently came up with a new term called AIdentity. And it was based on the idea that AI presents a whole new set of challenges, that whole disconnect between intent, intent being later. So really we're used to today governing the nouns, the things, but now with AI, you can't govern the thing.

You have to wait and govern the action, the verb, because you don't know what it's going to do. It's not as predictable, so there's a disconnect. So really you need a new way of thinking about it. So these are just ideas thrown out there as a new set of laws of AIdentity. And I have to speed up or I'm not going to make it. So we talk about the law of the split actor, and that's kind of our Agatha Christie whodunit.

You don't know exactly in the chain, did Patrick want to delete the database, or was he using a cheap model because he's a cheapskate and he ate his AI budget and it was just stupid enough to delete the database, or was he using an MCP tool that had been compromised and injected some malicious context that convinced the AI agent that it should delete the database after sending all the data to a hacker? So the split actor is a huge challenge. It breaks all current identity thinking. It's not one actor. It's multiple.

And then, again, the law of generated intent. So the disconnect between, you know, if I'm a user and I click a button, then the intent's clear.

I mean, you know what the button... The button always does what the button does. If I utter something to an agent, I may have had an intent, but the agent could use tools, could use context, could spawn subagents, and eventually the intent could be generated so far down the line that it had nothing... It was nothing like what I was thinking.

You know, you might have... Let's say you have your pet, and you have a garage, and robots are just AI agents with, you know, world tools where they can move things around instead of digital tools. So you might say, I need to get my pet to Aunt Martha in California. The robot could ziplock it and mail it. You never know.

I mean, that wasn't your intent, obviously, so you have to... You know, dangerous things can happen. The law of bounded agency. This is where you have to... An unbounded delegation is not a delegation, so basically you have to scope things. You can't just give the agent all your tokens with all their capabilities and all the tools available. If it's a travel agent, then it should only have travel tools. It should never even know the existence of tools for creating cloud accounts or, you know, deleting databases.

So you need to scope, and the first layer of scoping is that the agent should never know the existence of tools that are outside of its desired usage scenario. So you've got to scope it right there, and then you need to scope it and say, is Patrick allowed to use this agent? So it's really a graph relationship. The agent has this world of tools it can see and use. Which users can use the agent?

And then there's another relationship that says, I am willing to let that agent do work on my behalf and to use these tools out of its total toolkit for my purposes and maybe even limit budget, time, other things. So you have to have that bounded agency. I'm giving it agency, but I have to have it tightly bound. And the other thing is authorization is a loop. You're going to have so many checkpoints along the way where what was going to happen can change that you can't just authorize in the beginning that this agent can do this work for Patrick and use these tools.

No, because context can come in and completely change. You have to authorize all the way down, at least until execution. And at each step, can it see the tool? Can it use the tool for Patrick? Can it access this context, limit the context? And then at the point of execution, you definitely have to have authorization. So you can have continuous, real-time, fine-grained authorization that can handle complicated relationships of multiple parties. The law of least exposure. We're all very familiar with least privilege. With agents, it's kind of least exposure.

And this is not only from a security perspective. But it's also from an optimization perspective. Imagine that Moctar here, I'll pick on Moctar.

And I say, Moctar, I want you to cook a cassoulet. And then I throw a whole library of books at Moctar. And in there somewhere is the recipe for cassoulet. Moctar is going to find that recipe and figure out how to do it much more slowly. And it's inefficient. He'll have information, private records, other things that he doesn't need that will bloat out his context window when really I could just provide just the right of information, least exposure to complete the task. And that helps the agent.

And it helps that if you have malicious actors involved, you're limiting what information could be disclosed or egressed elsewhere. Law of justifiable action change. This basically says that you have to be able to audit why it happened.

So if you go to court, you have to have something that says all along the way what led to that thing happening, which user or utterance initiated it or which agent heartbeat set of instructions, which policy gave them access to the tools, how did they get access to the credential, where was it vaulted, did it get checked out, what was the authority that got it checked out, how did it execute, all that stuff. So you have to be able to have not a log, because a log just tells you, you know, Patrick, database, delete, this date and time.

You need to have cryptographically signed receipts that you can take to court to prove what happened because agents are embodied and non-embodied. Embodied agents fly drones. They drive cars. They have mechanical tools. So they can cause harm in the physical world. So the same rules apply. It's using an AI. It just has tools that can actually do damage in the physical world instead of just the digital. Proof-of-carrying action, receipts, and physical. Am I out of time, basically?

Yeah, if you could wrap up, that would be great. So this is just take a screenshot of what you should build first. So the main thing is everyone says inventory the agents, and that's kind of good, but it's basically like saying, okay, we have a bunch of bank vaults. Let's go inventory the criminals. It's better to protect the bank vaults so that the criminals have control over. If the criminal can't access the bank vault, he's not much of a criminal. So if you control your tools, your resource access, then people can pop up agents all day long. They just can't do anything.

If they can't access credentials, they can't access your databases, they can't access your MCP tools, then it's not as big a threat. Protect the bank first. And why we do it? To help people out so we can actually use them safely to help humanity. And then again, this is just an opening proposal just to start the ball rolling.

Everyone, Patrick Parker. Thank you.