Beyond the vault: Why AI agents force us to rethink Privileged Access Management (PAM)
Identity Decoded | The Identity Security PodcastShow Notes
Rohit Agnihotri has spent nearly two decades helping organizations rethink identity, building and leading IAM programs and advising executives on strategy. He's also the founder and host of the widely listened to Identity Navigator podcast. In this episode of Identity Decoded, he joins Roy Akerman and Rob Ainscough to make the case that traditional, vaulting-first privileged access management is dead, and to unpack what's replacing it. Rohit walks through why the old "vault everything" model breaks down under the sheer volume of machine identities, why standing privileges are one of the biggest attack vectors in the enterprise, and why organizations are shifting from vaulting to just-in-time access and, ultimately, zero standing privileges. The conversation turns to agentic AI, where Rohit introduces his own "Identity Uncertainty Principle": as an agent's autonomy increases, certainty about whether it's still the same agent you started with decreases. Together, they explore what that means for privilege, behavioral analytics, and why every autonomous agent needs a kill switch.
Key Topics
1. Why the old, vaulting-first model of PAM is dead
2. Moving from vaulting to just-in-time access to zero standing privileges
3. The Identity Uncertainty Principle: why more autonomous agents are less certain
4. Why every agentic AI identity needs a kill switch, not just a session timeout
🎧 Episode Highlights
[01:37]: Rohit's identity journey, from backend developer to IAM leader
[03:27]: Why the traditional, vaulting-first PAM model is dead
[07:57]: The rise of the authorization plane, and why brokered access is the future
[14:21]: Introducing the Identity Uncertainty Principle for agentic AI
[21:37]: Why agentic AI security can't be session-based, and the case for a kill switch
[26:33]: Rapid-fire round: identity myths, hard truths, and the most over hyped term in the industry
🔑 Key Takeaways:
● Vaulting credentials doesn't scale to machine identities. With machine identities projected to outnumber human ones by as much as 82ish to1 or more, vaulting every credential becomes too expensive to license, too static for identities that spin up and disappear, and too painful to review. Organizations are moving from vaulting to just-in-time access, and ultimately toward zero standing privileges.
● "What identities are privileged?" is becoming the wrong question to ask. Every organization defines privilege differently, and that inconsistency breaks down further with AI agents. Rather than asking how privileged an identity is, security teams are better served asking how much freedom it has to act, and what outcomes and risks that freedom creates.
● The more autonomous agents are, by definition, the less predictable they are, too. Rohit's Identity Uncertainty Principle holds that as an agent's autonomy increases, certainty about whether it's still behaving as originally intended decreases. Because agents can chain tools and pathways in ways no one anticipated, and carry none of the guilt, shame, or job-related restraint that shapes human behavior, security teams need dynamic risk scoring, behavioral analytics built for agents rather than humans, and a kill switch that can act in real time, not just at the end of a session.
👤 Guest Spotlight:
Rohit Agnihotri
Rohit Agnihotri has spent nearly two decades turning identity and access management from a technical function into a strategic business lever. His path into identity began early in his career writing back-end code, before a move to a startup introduced him to single sign-on and identity federation — and he's been leaning into the discipline ever since. He has led IAM from every angle, as a developer, architect, consultant, and executive, building and leading global teams at organizations including Northwestern Mutual, KPMG, and Cyberinc across IGA, PAM, cloud identity, and Zero Trust transformation. Today, CISOs and business leaders trust him to drive enterprise-wide
More from Identity Decoded | The Identity Security Podcast
Recorded live at Identiverse in Las Vegas, this episode of Identity Decoded brings co-hosts Roy Akerman and Rob Ainscough together with Dr. Rogerio Rondini, Head of Innovation at PwC Netherlands, who has spent 16 years working in identity. Rogerio argues that identity has grown from workforce access into federation, customer identity, non-human identity, and AI agents, yet most organizations still run it with the same siloed operating model: separate teams, separate tools, and separate budgets for workforce, customer identity, and privileged access. Tune in to hear what it takes to bring those pieces together, from why identity verification is no longer just a customer concern in the age of deepfake job candidates to how his team is exploring AI agents to help organizations see what good Zero Trust looks like, plus why bringing identity and cybersecurity closer may be one of the most powerful and important moves a security team can make.
In this episode of Identity Decoded, recorded at Identiverse, hosts Roy Akerman and Rob Ainscough flip the usual format with Simon Moffat, founder of analyst firm The Cyber Hut and a 20-plus year veteran of identity vendors including ForgeRock and Oracle. Simon argues that identity's traditional pillars — IGA, PAM, access management — were built for a linear, on-premises world, and they're now colliding under pressure from AI, non-human identity, and agentic systems. The conversation covers why category definitions provide clarity but should never be considered unshakeable, Simon's vision for a composable "identity operating system" built around horizontal capabilities instead of vertical products, and a practical framework for actually measuring whether identity controls are working.
In this episode of Identity Decoded, recorded live at Identiverse, hosts Roy Akerman and Rob Ainscough sit down with George Roberts, Principal Architect for Identity and Access at McDonald's, to talk about Identity Security at a scale few practitioners ever encounter. George manages 2.2 million workforce identities across 95 markets worldwide. The conversation covers how McDonald's built a single source of truth without 1,500 separate HR integrations, why frontline workers get a printed, paper-based MFA sheet as their "least common denominator" security factor, and George's long-term vision for verifiable credentials and distributed identity. They also dig into why identity teams get looped into new technology initiatives too late, and why George doesn't think AI or continuous identity are overhyped, just under-answered.
In episode two of this two-part series of Identity Decoded, hosts Roy Akerman and Rob Ainscough continue their conversation with Aaron Turner — this time tracing a surprising parallel between drug cartels and ransomware groups. Aaron was assigned to the US Department of Justice after 9/11 and spent 18 months working with DEA Special Operations Division under Steve Murphy and Javier Peña — the real-life figures behind Netflix's Narcos. He breaks down why both types of criminal organizations are, at their core, transnational, economically rational actors that rely on stolen or assumed identities to operate. The conversation moves from Pablo Escobar's "plata o plomo" model of corrupting trust, to franchise-style scaling that lets sophisticated attackers hide inside the noise of less-skilled affiliates, to Aaron's later work at Idaho National Lab building some of the first cyber-physical attack simulators — and what that taught him about identity segmentation across IT and OT environments.
In episode one of this two-part series of Identity Decoded, hosts Roy Akerman and Rob Ainscough sit down with Aaron Turner, who spent eight years at Microsoft during the founding of Active Directory — starting as a support engineer and later working on Active Directory, SQL Server, Windows Mobile, and Xbox Live. Aaron takes listeners back to the mid-'90s mindset that shaped Active Directory's design: a mission to "kill Novell" and sell more Windows and Office licenses, not to build a security boundary. The conversation traces how that original trade-off — deployment speed over security — led to decades of "identity debt," why LSASS (designed in 1998) has become a favorite target in modern ransomware-as-a-service kill chains, and what the NSA's declassified account of removing Russian actors from the US Treasury reveals about identity segmentation done right (and wrong).