Identity & Access
AWS AgentCore Identity Explained: Does It Solve It?
AgentCore Identity reached GA in October 2025, built on Cognito for agent workloads. What it covers on AWS, and where cross-cloud identity still needs help.
Identity & Access
Identity & Access
SSO, SCIM, MFA, RBAC, and tenancy — who can touch your AI systems, and how.
Start here
Identity for AI Agents: Non-Human IAM Guide
Identity and access for AI agents: the NHI lifecycle — ephemeral scoped credentials, rotation, revocation — plus the human IAM that governs operators.
Read the guide →
Identity & Access
How Many Non-Human Identities Per Human? The 2026 Data
NHI-to-human ratios cited in 2026 range from 45:1 to 144:1. The spread reflects different measurement scopes, not disagreement over the trend.
Identity & Access
Okta for AI Agents Explained: What It Covers
Okta for AI Agents reached GA in April 2026. What the identity layer covers, and what independent governance still needs to add for a mixed estate.
Identity & Access
Entro Security Alternatives: Secrets-Centric NHI Governance
Evaluating alternatives to Entro Security for secrets-centric non-human identity governance and how it compares to broader NHI platforms.
Identity & Access
Token Exchange for Agent-to-Tool Authorization
OAuth 2.0 Token Exchange (RFC 8693) is the standard mechanism for on-behalf-of agent authorization. Learn the flow, the claims that matter, and the constraints that keep delegation from becoming escalation.
Identity & Access
mTLS, SPIFFE, and Workload Identity for Agents
Workload identity gives an agent's runtime a cryptographic identity with no secret to steal. Learn where SPIFFE and mTLS fit, what they do not cover, and how they compose with agent-level identity.
Identity & Access
Oasis Security Alternatives: NHI Lifecycle Management
Evaluating Oasis Security alternatives for non-human identity lifecycle management, including how it compares to Astrix and platform-native options.
Identity & Access
How to Give an AI Agent Its Own Identity
Why AI agents need first-class identity and how to model it so every action is attributable, governed, and revocable without disrupting other systems.
Identity & Access
Sub-Agent Delegation with Scoped Tokens
An orchestrator that shares its credentials with sub-agents has no delegation model. Learn how to pass narrowed authority down a chain, bound the depth, and keep attribution intact.
Identity & Access
Agent Session Hijacking and Token Replay
Agent credentials live in more places than human credentials and last longer. Learn how agent sessions get hijacked, how tokens get replayed, and the binding techniques that stop both.
Identity & Access
Break-Glass Access for AI Operations
Standing production access for agent operators is a permanent risk in exchange for an occasional need. Learn how to build a break-glass path that is fast enough to use and controlled enough to trust.
Identity & Access
Agent Identity Spoofing and DID Verification
When agents from different organizations interact, a claimed identity is worthless without verification. Learn how decentralized identifiers and verifiable credentials establish agent identity across trust boundaries.
Identity & Access
Key Rotation for Agent Credentials
Rotation that has never been exercised is not rotation. Learn the overlap-window pattern, why agent fleets break rotation differently than services do, and how to make it routine rather than an incident.
Identity & Access
Agent Privilege Abuse and Continuous Authorization (ASI03)
Why point-in-time authorization fails for long-running AI agents, and how continuous authorization contains privilege abuse — OWASP ASI03.
Identity & Access
Secure Agent Offboarding and Deprovisioning
Organizations have human offboarding checklists and nothing equivalent for agents. Retired agents keep credentials, connections, and scheduled triggers. Here is the deprovisioning sequence that actually closes them.
Identity & Access
Machine vs Workload vs Agent Identity: The Differences
Machine identity, workload identity, and agent identity are not synonyms. What each term means, where they overlap, and what agents add.
Identity & Access
NHI Credential Lifecycle Management: A Practical Guide
Non-human identity credentials from issuance to revocation: provisioning, scoping, rotation, monitoring, and decommissioning without sprawl.
Identity & Access
Astrix Security Alternatives for NHI Governance in 2026
Evaluating alternatives to Astrix Security for non-human identity governance — and when agent-native identity needs a different layer.
Identity & Access
How to Authenticate AI Agents
How to give each AI agent its own identity and authenticate it with scoped, short-lived credentials — so every action is attributable and revocable.
Identity & Access
Threat Model: Agent Credential Theft
How AI agent credentials get stolen and abused, and the controls that limit blast radius: credential scoping, short lifetimes, rotation, and fast revocation.
Identity & Access
SSO and SCIM: Enterprise Identity for AI Tools
SSO and SCIM give enterprises full control over AI tool access — federated authentication plus automated lifecycle management that keeps access current.
Identity & Access
RBAC vs ABAC for AI Platforms
RBAC governs who can configure agents; ABAC governs what agents can do per request. Learn which model fits each authorization decision on an AI platform.
Identity & Access
How to Implement Least Privilege for AI Agents
Apply least privilege to AI agents with scoped credentials, per-connection policies, and delegation constraints that shrink your blast radius.
Identity & Access
User Account Self-Service and Admin Controls
How splitting user self-service from admin controls reduces the attack surface of an AI platform and keeps account hygiene manageable at scale.
Identity & Access
Security Policies: Passwords, Sessions, and IP Restrictions
Per-org security policies let tenants enforce password complexity, session timeouts, MFA mandates, and IP allow-lists — enforced server-side on every request.
Identity & Access
RBAC and Custom Roles for AI Operations
Fine-grained RBAC and custom roles let AI operations teams enforce least privilege across agents, workflows, and security settings — without admin grants.
Identity & Access
Organizing Access with Teams
Teams add a functional access layer beneath org roles: scoping agents, enforcing per-team budgets, and integrating SCIM for automated provisioning.
Identity & Access
Multi-Tenant Organizations and Membership
How multi-tenant org isolation protects AI agents and data, with invite flows, role lifecycle, and layered enforcement that prevents cross-tenant data leakage.
Identity & Access
Automating User Lifecycle with SCIM 2.0
SCIM 2.0 automates user lifecycle for AI platforms — collapsing the access-change window from days to minutes and enforcing token revocation on deprovision.
Identity & Access
Single Sign-On for AI Agent Management: SAML and OIDC
How enterprise SSO with SAML and OIDC maps IdP identities into org-scoped access for AI platforms — and why federated authentication matters for AI tooling.
Identity & Access
Passkeys and WebAuthn for AI Platforms
Passkeys eliminate phishing risk on AI control planes by binding credentials to the device. How the WebAuthn ceremony works and what to verify in any platform.
Identity & Access
MFA for AI Control Planes: TOTP and Backup Codes
How TOTP and backup codes protect AI control planes from credential theft, plus forced enrollment, step-up auth, and replay prevention.
Identity & Access
How Praesidia Authenticates Apps, Agents, and MCP Servers
How a unified identity layer authenticates users, apps, AI agents, and MCP servers through one front door with MFA, scoped credentials, and audit logging.