Right, so this afternoon I'd like to talk about when your AI agents need passports and the non-human identity crisis. And it's fair to say from the conversations I've had so far, we're halfway through the conference, everybody is painfully aware of this issue. So I'm going to talk a little bit about the problem but I am going to try and outline what I see as some solutions.
As I say, Jonathan Care, I lead the AI practice in KuppingerCole. So it's always sad when your clicker doesn't work. Can I have the next slide please? There we go. I thought I was doing well getting up the stairs. It turns out I've got to master the clicker as well. So your fastest growing workforce has no HR file. I'm going to say that one again. Your fastest growing workforce has no HR file. They outnumber non-human identities, outnumber us 50 to 1. I think we can make a confident assumption that when we all gather here again next year, I'll be telling you the number is then 10,000 to 1.
So come back next year and tell me if I'm right or not. But let's look at this in more depth. What is a non-human identity?
Well, service accounts and in the conversation I had again, you're all aware of service accounts and the risks they embody. So these long-lived things that like many long-lived accounts accrete privilege and they're a governance risk. They always have been. This is not new. API keys and secrets. These are buried in your organization and post quantum cryptography is coming for you. But that's my friend Alexi's conversation to have. But static credentials and code. We know this happens. We can see it in GitHub.
In fact, an American agency that should know better was exposed today. OAuth tokens. So bearer tokens with scopes.
Again, more secure than just a vanilla API key, but still awfully overbroad and rarely get revoked. Workloads.
So again, moving to the cloud. Pods, functions, VMs, federated, short-lived, all of these things. When they're done right, they're good.
However, there are plenty of ways to get this wrong. And we've talked over many years, I think, about the shared responsibility model and its failings. And I turn to certificates.
Again, post quantum cryptography is coming for you. So there are challenges all to their own with certificates. And finally, my particular...
Oh, look, it did that. I didn't know it did that. Agentic identities. AI agents acting on behalf of humans. Oftentimes acting as the humans. So that whole piece around everyone should have their own individual account gets violated straight away. And I want to go into this in more depth. Why are IAM playbooks breaking at the agent layer? I had this as a posit. I've gathered sufficient evidence to believe it to be true at this conference alone. The old model. An identity, a digital identity, is associated with a person.
As I said this morning, the ugly bag of mostly water that you see in front of you. Static credentials. Occasional rotation. Issued a password, issued a MFA token for your device. But very rarely, if ever, rotated. We authorize once at login, and we're good. Sometimes they expire after a day, a week, a year. But pretty much the token is long lived. And the audit log consists of human actions. Who did what? Who clicked on this button in the application? If any of you have done any work with fraud, you know this is quite common. Also operations on databases, and so on.
But let's look at the agentic reality. Identity is a person who has a process and an agent. And not just one agent, a whole chain of them. Tokens are minted per task and are valid for minutes rather than hours, months, or years. And we authorize continuously per call, per tool, per hop. And so the audit chain becomes who delegated to whom, and with what intent.
And again, I had a lot of conversations today alone about this elusive subject of intent. Credentials are our new front door. There's a space in front. Credentials are our new front door. 61% of these credentials are breached, and this involves identity-based attack vectors. Three in four credentials involve a non-human or machine credential. For those of you who heard my little funny story about the CSO saying, excuse me, why are you crawling all over our graph API?
Well, that was an agent acting with my credentials. And the average age of a leaked token is 18 months. This should make you shiver. So I'd like to go into more depth and talk about five failure modes. And I managed to predict the weather outside as well. Sprawl. Anyone not know what sprawl is? I've identified it as you have 30, 90 NHAs for any human user. You have Cloud IAM. You have SAS apps, secrets vaults, CI runners, code, and dozens of forgotten config files. These are peppered throughout your enterprise file structure. Discovery is the single weakest link.
So again, we're going to be talking more about discovery in this presentation. Overprivilege. Overprivilege is easy, and we all know this. Back when I was a novice engineer writing code, I would set everything to be suid roots, and I had no problems working. And then someone pointed out how easy it was to do an LD preload, and all of a sudden, my suid program is doing something quite unexpected. And this is amplified with agentic. Agents reason. And I know that that's a philosophical discussion, but bear with me. What do they need at call time?
Without scope down, they will hold the broadest permission possible. They'll hold the broadest permission possible. Secret rot. API keys stuffed in source repos. For one of our internal tools, I wrote a marvelous thing that was analyzing Reddit sentiment for our research. And my friend, the CTO said, excuse me, you do realize you've committed your Reddit secret to our source code repo, and you need to rotate that immediately. Service account passwords that were last rotated in 2019. Not that far away.
Long ago, is it? Vault entries that are still active for engineers who left for new reorganizations. In my career before I became an analyst, I did some forensic investigation on this very thing. Engineers who still had active accounts setting up very profitable businesses, servicing the machines they used to work on.
Which, depending on your view, but that's a problem for the organization. And again, static, long-lived secrets will accumulate, and they will accumulate quietly out of our visibility until somebody, either an attacker or an auditor, finds them. So how does, again, agentic amplify this?
Agents, of course, need credentials to act. And if your secrets are stale, every new agent you ship is built on rot. No provenance.
So again, today's logs show credentials once used and human intent behind it. That's fine. How do we determine agentic intent?
Yesterday, I had a very knowledgeable person saying, you can judge intent by past actions. That is not what intent is. Intent is what you are going to do in the future. So we know, and for those of you who've looked at the research from Anthropic and indeed OpenAI, we know that the thinking processes of these models actually differs from the post action rationalization they offer. This should give all of us pause for thought. Like I said, multi-agent workflows pan out. Four or five hops down. I have no visibility of what it's doing. I have no communication necessarily with what it's doing.
Unless I have a delegation change, if I am trying to investigate a breach, I hit a brick wall. I cannot determine accountability and the delegation chain. All of this, of course, leads to trust collapse. If an agent can talk to tools, which, of course, that's what we wanted to do, talk to external services, then if the tool is compromised, the protocol or the prompt, and the identity is compromised, which if you have blithely let the agent run under your identity, means you are in trouble.
Recent issues with agent protocols and plugins, we're not there in terms of code security and quality by a long chalk. We can easily coerce an agent into exfiltrating its own tokens. My favorite tool when I'm playing around and trying to get an agent to act out is to see if I can get it to sing a song about potatoes. I have never failed yet. Prompt injection.
Again, we talked about this in the workshop yesterday. We've collapsed the data and control planes. We communicate through one interface to these agents.
So, an instruction that elevates privilege can arrive in a web page. And if you look at the work of Andrej Karpathy, he actually demonstrates this on his page. If you go to his web page, read it, or if you have your agent read it, even more so, you then find that Andrej Karpathy is an expert on unicorns. It's his hidden text.
So, having made you all feel gloomy, multiply all five. Sprawl, overprivilege, secret rot, no provenance, trust collapse. We are trying to catch up at human speed, and the agents are here.
Well, I don't like just admiring problems. I like to try and offer solutions.
So, here's my attempt. Issue them passports. And there are five controls I've outlined that constitute a passport, and I'm going to offer them to you now. First of all, one identity per agent. Every agent gets its own identity. A good looks like workload identity providers, IAM role service accounts, never any shared keys in a vault called production bot. Would anyone like to be brave and say if they have a prod bot entry somewhere in their secret vault?
Thank you, sir. You're in good company, it's just you're braver than everybody else. Make them short-lived. Make them scoped, and make them federated.
So, as I said, long-lived secrets are the original sin. We made that mistake, and it is pervasive.
So, stop minting long-lived secrets. Static API keys, static passwords, replaced with short-lived scope-based tokens issued at the moment of use. Workload identity, and again, what good looks like. Token TTL measured in minutes. Scope claims pinned to the calling. Issue assigned every credential, which means we may have a human load involved for the initial minting, the initial creation, instantiation of the agent, but we should have zero static secrets in our code or in our configs. Delegation with provenance.
So, the way agents work, they like to delegate, and we want them to delegate. We cannot restrict this. We will lose the good that we were trying to achieve.
However, we need to carry the human intent through every hop. So, it needs to know this is an agent instantiated by Jonathan Kerr. Jonathan Kerr instantiated this agent in order to be able to share a summary of his calendar with his wife. That's something I use my personal AI for. And the delegation chain should carry that, along with an authorization token, so that when we are trying to work out what went wrong, we have a path to it.
So, again, OAuth on behalf of token exchange, human to agent exchange flows, verifiable claims on every agent to agent hop, and end-to-end correlation IDs in your sim. I keep saying it. The sim is not dead. We need it, and we need it badly at this point. Continuous authorization.
Again, what good looks like for me, policy decision points sit between every agent, every tool. I'd actually posit that this has developed since I originally wrote this deck, and I would have an agent garden with a fine-grained authentication tool within it.
So, we are, say, moving very quickly through these, but again, things to watch for. Behavioral baselines per NHI. I talked about intent and how that's possible, or that's hard to measure.
However, behavior is easy to measure, and we should do so to spot when anomalies crop up. This idea of the kill switch revocation.
Yes, it's important, and you should be building it in or planning to, and the kill switch should come out automatically in cases, for example, when the human leaves the company. All agents instantiated should be killed. And life cycle as a first-class citizen. It sounds odd. I want you to treat your agents like employees. I want you to onboard them. I want you to train them. Agents usually have a file, like identity MD or sole MD, and you should embed your corporation values within them.
You should embed the tenets of your security policy, the guardrails that you expect it to follow within those files. And so, not only do we have a human owner, an expiry date, and a deprovisioning path, we also make sure the agent converts to the workload that owns them. If we have a human owner and a workload, and autorotation, then it's quite easy to do quarterly access review. I had a question in a one-on meeting about how should this be done.
Well, actually, it's probably going to be done by yet another agent. So, I want to give you a 90-day plan, and this is a slide you should photograph. And first step, discover.
Secondly, govern. And thirdly, automate.
So, what was I involved there? Everybody I've spoken to is having trouble with inventory. That is your first step, knowing what the problem looks like. And I can assure you, if you haven't done inventory, it's probably worse than you think it is. And each of those things you discovered should be tagged with the human owner. Is it somebody in HR? Is it me? And so on. I'd say governance, and finally, automation of that path. I'd like you to consider where your organization is right now, and the maturity tree.
As I say, many organizations, and sadly, some people I've spoken to very recently are in the, well, we only have a few service accounts. No, you don't.
Really, no, you don't. We need to get to this stage inventory quickly, and I mean now, quickly. And from there, we move through hardening, federation, and what I call passport grade.
So, we talk about identity being the new perimeter. It has just doubled. We have a new dimension of access, and therefore, a new dimension of attack surface. Humans plus agents. Agents plus tools. Tools plus other agents.
And so, that perimeter that we defended has expanded geometrically, exponentially. Take your pick. That's the end of my presentation. Thank you very much for listening. The three things I would like you to remember. If you forget everything else, inventory beats everything else. Kill your loneliest secrets first, now, and finally, treat your agents like employees. Thank you very much, and if you have any questions.
So, thank you very much, Jonathan. That was very much to the point, just in time.
