Identity & Access
Governing Google Vertex AI Agent Engine Deployments
What Vertex AI Agent Engine's IAM-based identity and logging cover for agents on Google Cloud, and where multi-cloud and MCP-connected tools fall outside it.
Identity & Access
Identity & Access
SSO, SCIM, MFA, RBAC, and tenancy — who can touch your AI systems, and how.
Start here
Identity for AI Agents: Non-Human IAM Guide
Identity and access for AI agents: the NHI lifecycle — ephemeral scoped credentials, rotation, revocation — plus the human IAM that governs operators.
Read the guide →
Identity & Access
Governing Azure AI Foundry Agent Service Deployments
What Azure AI Foundry's native identity and monitoring controls cover for agents, and where cross-cloud and cross-SaaS governance gaps remain.
Identity & Access
The Claude Agent SDK's Permission Model, Explained
The Claude Agent SDK evaluates tool permissions in a strict six-step order, with a documented subagent inheritance gotcha. What the official docs say to check.
Identity & Access
The Vercel Breach: One 'Allow All' OAuth Grant to an AI Tool
Vercel confirmed a breach traced to one employee's 'Allow All' OAuth grant to an AI tool. Why this is an identity failure, not a code vulnerability.
Identity & Access
AWS AgentCore Identity Explained: Does It Solve It?
AgentCore Identity reached GA in October 2025, built on Cognito for agent workloads. What it covers on AWS, and where cross-cloud identity still needs help.
Identity & Access
How Many Non-Human Identities Per Human? The 2026 Data
Non-human identities per human: CyberArk's survey reports 82:1 and Entro Labs counts 144:1. Why the two differ and which one to cite.
Identity & Access
Okta for AI Agents Explained: What It Covers
Okta for AI Agents reached GA in April 2026. What the identity layer covers, and what independent governance still needs to add for a mixed estate.
Identity & Access
Entro Security Alternatives: Secrets-Centric NHI Governance
Evaluating alternatives to Entro Security for secrets-centric non-human identity governance and how it compares to broader NHI platforms.
Identity & Access
Token Exchange for Agent-to-Tool Authorization
OAuth 2.0 Token Exchange (RFC 8693) is the standard for on-behalf-of agent authorization: the flow, the claims that matter, and the limits that stop escalation.
Identity & Access
mTLS, SPIFFE, and Workload Identity for Agents
Workload identity gives an agent's runtime a cryptographic identity with no secret to steal. Where SPIFFE and mTLS fit, what they miss, and agent identity.
Identity & Access
Oasis Security Alternatives: NHI Lifecycle Management
Evaluating Oasis Security alternatives for non-human identity lifecycle management, including how it compares to Astrix and platform-native options.
Identity & Access
How to Give an AI Agent Its Own Identity
Why AI agents need first-class identity and how to model it so every action is attributable, governed, and revocable without disrupting other systems.
Identity & Access
Sub-Agent Delegation with Scoped Tokens
An orchestrator that shares its credentials with sub-agents has no delegation model. How to pass narrowed authority down a chain, bound depth, keep attribution.
Identity & Access
Agent Session Hijacking and Token Replay
Agent credentials live in more places than human ones and last longer. How agent sessions get hijacked, how tokens get replayed, and the binding that stops it.
Identity & Access
Break-Glass Access for AI Operations
Standing production access for agent operators is a permanent risk for an occasional need. How to build a break-glass path fast enough to use and safe to trust.
Identity & Access
Agent Identity Spoofing and DID Verification
A claimed agent identity is worthless without verification. How decentralized identifiers and verifiable credentials establish it across trust boundaries.
Identity & Access
Key Rotation for Agent Credentials
Rotation that has never been exercised is not rotation. The overlap-window pattern, why agent fleets break it differently, and how to make it routine.
Identity & Access
Agent Privilege Abuse and Continuous Authorization (ASI03)
Why point-in-time authorization fails for long-running AI agents, and how continuous authorization contains privilege abuse — OWASP ASI03.
Identity & Access
Secure Agent Offboarding and Deprovisioning
Retired agents keep credentials, connections, and scheduled triggers. The agent offboarding and deprovisioning sequence that actually closes them.
Identity & Access
Machine vs Workload vs Agent Identity: The Differences
Machine identity, workload identity, and agent identity are not synonyms. What each term means, where they overlap, and what agents add.
Identity & Access
NHI Credential Lifecycle Management: A Practical Guide
Non-human identity credentials from issuance to revocation: provisioning, scoping, rotation, monitoring, and decommissioning without sprawl.
Identity & Access
Astrix Security Alternatives for NHI Governance in 2026
Evaluating alternatives to Astrix Security for non-human identity governance — and when agent-native identity needs a different layer.
Identity & Access
How to Authenticate AI Agents
How to give each AI agent its own identity and authenticate it with scoped, short-lived credentials — so every action is attributable and revocable.
Identity & Access
Threat Model: Agent Credential Theft
How AI agent credentials get stolen and abused, and the controls that limit blast radius: credential scoping, short lifetimes, rotation, and fast revocation.
Identity & Access
SSO and SCIM: Enterprise Identity for AI Tools
SSO and SCIM give enterprises full control over AI tool access — federated authentication plus automated lifecycle management that keeps access current.
Identity & Access
Agentic Identity: Descope and WorkOS Alternatives
Descope and WorkOS's identity-platform category explained, how it extends toward agentic identity, and where a dedicated agent governance layer differs.
Identity & Access
RBAC vs ABAC for AI Platforms
RBAC governs who can configure agents; ABAC governs what agents can do per request. Learn which model fits each authorization decision on an AI platform.
Identity & Access
How to Implement Least Privilege for AI Agents
Apply least privilege to AI agents with scoped credentials, per-connection policies, and delegation constraints that shrink your blast radius.
Identity & Access
Governing LlamaIndex Agents: Data Access and Retrieval
LlamaIndex builds and queries indexes over your documents. Authorization for who can query what is the layer around it — here is where that boundary sits.
Identity & Access
Governing Haystack Agents in Enterprise Search
Haystack pipelines power enterprise search and RAG agents — but a retriever without document-level ACL enforcement will surface what the index holds.
Identity & Access
Token Security Alternatives for Non-Human Identity
Token Security discovers and secures non-human identities across the enterprise estate. What that covers, and what agent runtime governance adds.
Identity & Access
Deploying SPIFFE/SPIRE for AI Agent Identity
How to plan a SPIFFE/SPIRE deployment for agent workloads: trust domains, attestation policy, federation, and the operational pitfalls that show up first.
Identity & Access
Enterprise IdPs and AI Agents: The Ping Identity Case
Ping Identity's enterprise IdP stack extends to agent authentication like its peers. What that coverage includes, and what runtime governance still owns.
Identity & Access
Keycloak for AI Agent Identity: What You Must Build
Keycloak's realms, clients, and token exchange cover agent authentication cleanly. What agent delegation and per-tool scoping still require you to build.
Identity & Access
HashiCorp Vault for Agent Credentials: Patterns and Limits
Vault's dynamic secrets and leases fit agent credentials well. The patterns that work, and where lease-based secrets stop being enough for agent behavior.
Identity & Access
Microsoft Entra Workload Identity for AI Agents
Entra's managed identities and federated credentials remove standing secrets for Azure workloads. What that covers for agents, and what Entra Agent ID adds.
Identity & Access
Secrets Vault vs Agent Governance: Where Each Stops
A centralized secrets vault removes scattered credentials from agent deployments. What it fixes for AI agents, and what it leaves for another layer.
Identity & Access
Britive Alternatives: Just-in-Time Access for Agents
Britive grants just-in-time privileged cloud access that expires automatically. Where that checkout model fits agents, and where it breaks down.
Identity & Access
Federating Agent Identity Across Multiple Clouds
Agents rarely stay in one cloud. How OIDC federation, SPIFFE trust-domain federation, and DIDs let agent identity cross cloud boundaries without shared secrets.
Identity & Access
Aembit Alternatives: Workload Identity for AI Agents
Aembit issues secretless credentials to workloads. Where that covers AI agents, and where delegation and tool scoping need another layer.
Identity & Access
Organization API Keys and Scopes
Issue, scope, and rotate organization API keys to give each integration only the access it needs — and limit blast radius when a credential is exposed.
Identity & Access
How to Run an AI Agent Access Review
A step-by-step procedure for reviewing what every AI agent can access, who owns it, and whether its actual usage still matches its granted scope.
Identity & Access
User Account Self-Service and Admin Controls
How splitting user self-service from admin controls reduces the attack surface of an AI platform and keeps account hygiene manageable at scale.
Identity & Access
Security Policies: Passwords, Sessions, and IP Restrictions
Per-org security policies let tenants enforce password complexity, session timeouts, MFA mandates, and IP allow-lists — enforced server-side on every request.
Identity & Access
RBAC and Custom Roles for AI Operations
Fine-grained RBAC and custom roles let AI operations teams enforce least privilege across agents, workflows, and security settings — without admin grants.
Identity & Access
Organizing Access with Teams
Teams add a functional access layer beneath org roles: scoping agents, enforcing per-team budgets, and integrating SCIM for automated provisioning.
Identity & Access
Multi-Tenant Organizations and Membership
How multi-tenant org isolation protects AI agents and data, with invite flows, role lifecycle, and layered enforcement that prevents cross-tenant data leakage.
Identity & Access
Automating User Lifecycle with SCIM 2.0
SCIM 2.0 automates user lifecycle for AI platforms — collapsing the access-change window from days to minutes and enforcing token revocation on deprovision.
Identity & Access
Single Sign-On for AI Agent Management: SAML and OIDC
How enterprise SSO with SAML and OIDC maps IdP identities into org-scoped access for AI platforms — and why federated authentication matters for AI tooling.
Identity & Access
Passkeys and WebAuthn for AI Platforms
Passkeys eliminate phishing risk on AI control planes by binding credentials to the device. How the WebAuthn ceremony works and what to verify in any platform.
Identity & Access
MFA for AI Control Planes: TOTP and Backup Codes
How TOTP and backup codes protect AI control planes from credential theft, plus forced enrollment, step-up auth, and replay prevention.
Identity & Access
How Praesidia Authenticates Apps, Agents, and MCP Servers
How a unified identity layer authenticates users, apps, AI agents, and MCP servers through one front door with MFA, scoped credentials, and audit logging.