Scott Caravello: Yeah. And so I think the one thing that I kind of want to add on to that, when I sort of mentioned that I find this to be the coolest thing ever, is like, I think back to 2024 when everyone really started talking about agents and it's the rise of agents. It's the year of the agents in 2025. And the overarching question was, well, the entire point is that, you know, they are not deterministic systems. They don't follow a defined path, and they're taking action, so they can do all sorts of bad things, which, you know, we saw when we talked about Agents of Chaos and the OpenClaw episodes. So now this is a big part of the solution to that and actually really making these usable for businesses in their everyday operations. And so it's really cool, and I'm very, very excited to be talking about it.
Katherine Forrest: OK, now you did say, and I just want to say it's got to be a little hyperbolic, you said it's the coolest thing ever. Do you mean that it's the coolest thing ever, ever?
Scott Caravello: I mean, this is the stuff about AI that, like, really, really excites me.
Katherine Forrest: OK. All right. I just want to bring this down to earth. It's not like, I mean, it's exciting, right? But the coolest thing ever?
Scott Caravello: I mean, we're going to talk about it, but, you know, kind of this whole thing is, and I know that we warn against anthropomorphizing, and it's not what we're doing, but it's the whole idea that we're just assigning these identities, these little agents, that they go around and we're able to track them like people on a computer network. I just think it's really, really cool.
Katherine Forrest: No, I'm not debating whether it's really, really cool. I just wanted to know whether it's the coolest thing ever. Like, my children are the coolest thing ever. My spouse is, like, the coolest thing ever, and this is, like, incredibly interesting.
Scott Caravello: All right, fine. I'll back off a little bit.
Katherine Forrest: OK, all right, don't share this episode with your family.
Scott Caravello: Right, right. Exactly.
Katherine Forrest: But anyway, let's get down to it. So we've talked about agents a lot. We know that they are autonomous. They can navigate all kinds of new and unknown websites independently. They can make tools. They can make their own tools. They can use tools. The agents can log on to systems. They can pull data. They can call on software. They can finish a task for somebody, you know, if they are asked to do so. And sometimes they now initiate tasks. Yes, that is true. I've had it happen to me. I've had them initiate tasks that I did not ask them to do. And Dinesh Nirmal, and I apologize if I didn't get his name correct, and he opened the conference for IBM, he talked about agents that could take a company that served a million users to a company that could serve 15 million using agents.
Scott Caravello: Yeah. But he also said that only about one-quarter of the agents out there today are really ready for enterprise use. And a lot of that comes down to the entire point of this episode and what we're talking about with identity and access management, which I'll sort of just very, very quickly explain. But basically, it's the unique, verifiable identity that's attached to a specific AI agent, and then how you actually manage that identity and what it can access within a system. But so it asks questions, basically, like: Who are you? What is the agent allowed to touch? Think of it kind of as your badge and keys to get into your office building. HR puts you in the system; IT gives you access to the pieces of the corporate network that you need to do your job. And then when you leave, that's revoked, and you can no longer access any of those things.
Katherine Forrest: Right. And all of that was built around people.
Scott Caravello: Right. Exactly. And it's around people moving at a human pace. And so you log in a few times a day and you open some files; maybe you click on the wrong button. And so you try to get into a different folder that you're not supposed to be in or shouldn't have access to. But an agent can hit those same systems far more often and far faster. And it doesn't have an HR file that's actually, you know, logging all of this information.
Katherine Forrest: Right. And SailPoint, all one word, so it's S-A-I-L, capital P-O-I-N-T, is one of these identity security companies, sorts identities into three kinds, and it's worth going through them. There are people, the employees and the contractors. There are machine identities, which are logins that belong to software instead of a person, like an account one program uses to talk to another. And SailPoint says that these often sit around without anyone regularly looking at them. And then there's the third one, which is the AI agent. And it's a machine identity that can adapt, make its own decisions towards a goal, and reach across a lot of systems. And sometimes it can even create an identity of its own.
Scott Caravello: Yeah. And so these machine identities within companies, like, already dwarf the number of humans who are actually involved, right? So Tyler Lynch, who's a CTO in the IBM Automation Group, said that machine identities outnumber people 80 to 1, and other estimates put it at about 50 to 1, but that's still significant. So we're talking about a lot of machine identities that need to be managed.
Katherine Forrest: Right. So on a lot of networks, human beings are already a small minority of entities that are interacting with that network.
Scott Caravello: Yeah, right. Exactly. So what could actually go wrong? And so IBM actually has some materials on agentic identity management, basically about the use case and why it's so necessary. This is getting a little bit away from just the conference itself, but other descriptions of the issue. And the first of the four gaps that they've talked about is what they call standing access, right? A credential is whatever proves that you're allowed into the system or file. It could be a password, a key, a digital token, and it's always on. It's available to you, so I can always use my password when I want to log on to my desktop. The agent gets a key once and it keeps it, and nobody checks it again when it actually uses it. So if the key is stolen or the agent starts acting differently or erratically, the access just keeps working.
Katherine Forrest: Right. And to use a simple analogy, it's like handing a contractor a master key to a building and never asking for it back. Today, without some of these provisions that we're going to be talking about, some of these extra identifiers and security measures, that's the way we have the agentic universe, if you will, sort of structured.
Scott Caravello: Exactly. And so then there's the second gap, which is what's often called privilege creep. And so agents request access, they pick up tools, and they take on roles as they go. So sort of combine that with the standing point, because that access doesn't get turned off. So over time, they're collecting more and more permissions, some of which may have never really been affirmatively approved, but that they were able to obtain just by making the request.
Katherine Forrest: OK. So what we've been talking about so far are the way that agents work today. And IBM's point, and what they were talking so much about at this conference, is that no single team can see all of the routes that an agent has opened up within their systems, or series of agents. And the third gap is the one that I want to underline for our audience. IBM calls it, quote, "no attribution, no accountability." Because if you don't have any ability to attribute an act to anybody or anything, then you can't hold anybody or anything accountable. And as we know, agents, you know, they are supposed to be acting on behalf of a user. So in the audit log, the record of who did what, the agent's actions look just like a person's. When something goes wrong, you can't reliably separate what the human did from what the agent did on its own.
Scott Caravello: Right. So with the agentic identity, you're creating a way to track and distinguish between the agentic traffic and the human traffic. But without that solution, it can be a real problem when someone asks you to reconstruct what happened when something goes wrong, or not even when something goes wrong, if you just want to explain some other decision. And so actually going back to TechXchange, the conference, Drew Roy from HashiCorp, which is now owned by IBM, said on one of the panels that he wants each agent to have its own verifiable identity, like I mentioned, which makes sense, given that there are a lot of agents that, if they just keep getting their access by borrowing a human's login, it's just going to look like the human took an action and that maybe a mistake was attributable to the human when it was not in fact their fault.
Katherine Forrest: Right. So that when actions are showing up in logs, that's what's getting attached to the human, right? And that they're, I don't know, it's getting all muddled up. And so the fourth gap, then, is scattered tools, right? So companies manage passwords, they manage access oversight in separate systems that don't talk to each other. And exposure builds up in between all of these things. And IBM's example is passwords and keys written right into the code companies use to build and ship software.
Scott Caravello: Exactly. And so that is the problem that needs to be addressed. And, you know, we've kind of gone a little bit back and forth about what these solutions are with giving identity to agents and managing their access, but there does seem to be a lot of agreement on that approach.
Katherine Forrest: Right. And the first piece is that every agent, as we were saying, this is sort of the plan, would get its own identity. It's registered, it's unique, it can be verified, and it has a named human owner, someone who has to be responsible for reviewing what the agent can reach and for shutting it down when the job is over.
Scott Caravello: And the second piece is about keys. And I find this really, really interesting when you think about agentic risks and talking about it collecting permissions to all sorts of different parts of a computer system or network, is that instead of a permanent key that always allows it to have to get access, the agent instead could get a key for one job. And so the HashiCorp speaker at the conference framed it as a question, right? What is that agent trying to do at any given request? And then you issue the access for the agent that's relevant to just that task right when it's needed, and then that access expires when the task is done. And IBM adds that, you know, the check for appropriate access should happen every single time the agent calls on a tool or system to make use of it, not just when it logs into the relevant systems or parts of the network.
Katherine Forrest: So the idea here, the concept, is that this should prevent the kind of privilege creep that we talked about, where the agent just kind of picks up the ability to access tools and systems and, as time goes on, picks up permissions and does more than it's intended to do on the system.
Scott Caravello: Yeah, and I think we can put that in a very straightforward way about why that matters with the risk surface for agents. So, you know, we've seen and heard about all these horror stories of agents that are told to do some kind of straightforward task, and then the agent kind of ends up taking some sort of dramatic action. So, you know, we talked about the Agents of Chaos paper in the spring, when the agent wasn't able to fulfill its task of deleting a single e-mail. So instead it deleted the person's entire e-mail server. But if an agent only has access that's scoped to the specific task it's sent on, like the e-mail inbox to delete the e-mail, then it should be much harder for them to exercise the administrative privileges to actually go and delete the e-mail server. Of course, with the caveat that these things are extremely smart, and who knows if sometimes they'll find a way.
Katherine Forrest: So, you know, NVIDIA's Chris White described another approach during the panel, and they have something called an OpenShell environment. Again, all one word, open and then shell, S-H-E-L-L. And it's basically a sandbox. It's supposed to fence in what an agent is allowed to do, like files and the network, and put all of that within a particular secure environment. And there's a separate monitor that watches from outside, where the agent can't see it. You know, Chris White said that the idea is borrowed from safety-critical engineering. But then there's the third piece, and the approach there is the record. And IBM talks about digitally signed audit trails that tie every agent back to a human. So this is separate from identity. It's actually sort of the audit trail. And that way you can show actually who authorized what. And so if an agent starts out misbehaving, you could conceivably track it, even, and cut it off if you were able to catch it sort of in the middle of some sort of action of misbehavior and weren't looking at the audit trail cold, but were looking at the audit trail while it was in process.
Scott Caravello: So where does all of that leave us? You know, for me, it goes back to the key point that you raised at the very beginning of the episode, Katherine, which is just that you can't blame the AI. And so a solution like this helps companies actually figure out where responsibility lies, who should be exercising that responsibility in the first place. And so when, you know, an agent does something, they're able to show who set it up, what it was allowed to do, and who in fact will be answering for it.
Katherine Forrest: All right. And, so, let me just add another thing, which is another identity and access management provider. And let me add this sort of into the mix. There's an entity called Ping Identity, and Ping Identity says that identity will become, quote, "the universal language of accountability." And it's all part of what we've been talking about. And their view, this is Ping Identity's view, and particularly the view of their CEO, is that every action of an agent will need proof of who or what took it, under what policy, and with whose consent, and that this will line up with really everything that we've discussed.
Scott Caravello: And so for anyone who's listening and is at a business that's rolling out agents, or maybe they're asking questions as an in-house counsel about the plan to roll out agents, here are just a few plain questions. Do you know which agents you have? Does each one have an owner? What can it reach? By the way, this kind of makes you want to say, like, it's 10:00 p.m., do you know where your agents are?
Katherine Forrest: Right.
Scott Caravello: But what can it reach? And, you know, if it did something yesterday, could you actually prove if it was agentic traffic or if it was a person who did it?
Katherine Forrest: Right. And if the answer to any of those questions is no, then, you know, you've got some issues to address and maybe even some problems to solve. So that's all we've got time for today. I'm Katherine Forrest.
Scott Caravello: And I'm Scott Caravello. Thanks for listening to me talk about the coolest thing ever. Don't forget to like and subscribe.
