Sameer Mehta is Mr NHI's Human Identity In The Hot Seat

Policy Enforcement for AI Agents: Why Human Approvals Can’t Keep UpAI agents are requesting access at machine speed, chaining MCP tool calls across ten or more applications and spawning sub-agents. Access policies built for humans waiting on approval tickets can’t keep pace.Sameer Mehta, Chief Product Officer at Opal Security and former product leader at Veza, joins Lalit Choda (Mr. NHI) on the Non-Human and AI Identity Podcast. He explains why policy enforcement for AI agents needs a new model. That model treats agents as mission-driven software with no conscience, combines fixed rules with AI-driven decisions, and stops granting standing access based on “vibes.”The conversation covers why agents are already reaching production without proper security guardrails, and how to keep policy as code predictable when the agents it governs are non-deterministic. It also covers how agent manifests expose off-purpose agents, and why access decisions only scale when an AI agent approves, denies or escalates them.What you’ll learn:Why identity security doesn’t need to be thrown away for agentic AI: the problems are the same, but the scale and attack surface have changedHow standing access piles up in production through judgment-call approvals, and why it goes unnoticedWhy AI agent security and NHI security share ownership challenges but are not the same thingWhy one-size-fits-all access policy breaks for agents, and how to set policy by identity type, resource sensitivity and agent lifespanHow to combine fixed rules and custom instructions with AI-driven access decisions so outcomes stay predictableHow agent manifests reveal off-purpose agents that stray beyond their declared MCP tool call chainHow to evolve policy from access-decision data: move routine requests to birthright access or auto-approval, and keep humans in the loop for privileged resources and break-glass accountsKey Moments:Introduction & Meet Sameer [00:00–03:15]Mr. NHI’s Human Identity in the Hot Seat [03:15–19:36]What Security Teams Are Asking About AI Agents [19:36–24:16]Is Agent Risk Exposing the Wider NHI Problem? [24:16–25:52]Why Human-Era Access Policy Breaks for Agents [25:52–28:44]Building a Policy Model for Agents: Paladin & Policy as Code [28:44–32:32]Policy as Code vs Non-Deterministic Agents [32:32–36:43]Real-World Example: Custom Instructions & Human-in-the-Loop [36:43–40:00]From Humans to Agents: How Paladin & Opal 0 Evolved [40:00–45:01]Agent Manifests & Detecting Off-Purpose Agents [45:01–47:12]Upfront Policy vs Learned Policy [47:12–50:30]Advice for Security Leaders: Start, Measure, Iterate [50:30–51:50]Learn More About Opal & Closing [51:50–53:31]📚 NHI Knowledge Centre: nhimg.org🔗 Opal Security: opal.dev#NHI #NonHumanIdentity #AIAgents #AgenticAI #IdentitySecurity #MrNHI #DigitalIdentity #IAM #PolicyAsCode #PolicyEnforcement #AccessControl #IdentityGovernance #IGA #LeastPrivilege #JustInTimeAccess #MCP #AgenticSecurity #Cybersecurity #MachineIdentity #CISO #AccessManagement #PAM #ServiceAccounts #AgentSecurity #ArtificialIntelligence

AI Agents Are Non-Deterministic, Non-Trustable — and Already in Your Production Environment Alex Bovee, CEO and Co-Founder of C1.ai and former security product leader at Okta, faces Mr. NHI's Human Identity in the Hot Seat — 10 machine-speed questions on IAM, agentic AI security, non-human identity, and the future of the digital workforce. ───────────────────────────────────── KEY TAKEAWAYS Identity security was built for humans using SaaS apps — that world no longer exists The surface area of the enterprise has fundamentally exploded with agentic AI Everyone is a builder now — and the world is very, very messy IAM for AI is the bigger imperative over AI for IAM AI agents are being deployed into production without security guardrails — 100% Agentic AI security and NHI security aren't the same thing Agents are non-deterministic and non-trustable — unlike humans and unlike software AI agents already create and provision other identities — and that's not necessarily bad, but it needs control points The insider threat has been amplified by agentic AI — UEBA is making a comeback Would Alex trust an AI agent to make a decision impacting his own security? No. ───────────────────────────────────── CHAPTERS Introduction [00:00] Have We Built Identity Security for a World That No Longer Exists? [00:18] Are CISOs Ready for the Fleet of Autonomous Digital Employees? [01:25] Is IAM for AI More Important Than AI for IAM? [02:47] Are AI Agents Being Deployed Into Production Without Security Guardrails? [04:08] Does Agentic AI Security Equal NHI Security? [04:16] Do AI Agents Behave More Like Employees or Software? [05:40] Do Agents Need Background Checks Like Humans? [08:21] Should AI Agents Be Allowed to Create and Provision Other Identities? [08:51] Will the AI Agent Digital Workforce Lead to Mass Unemployment? [09:24] Would You Trust an AI Agent to Make a Decision Impacting Your Own Security? [10:52] ───────────────────────────────────── RESOURCES NHI Knowledge Centre: nhimg.org C1: c1.ai ───────────────────────────────────── From The Non-Human & AI Identity Podcast #CyberSecurity #NonHumanIdentity #IAM #AIAgents #IdentitySecurity #AgenticAI #ZeroTrust #DigitalIdentity #NHI #MachineIdentity #IdentityGovernance #CISO #RuntimeAuthorization #AgenticSecurity #ServiceAccounts #APIKeySecurity #InsiderThreat #AccessManagement #C1AI #MrNHI

Identity is the 3rd Generation of Security Identity security, IAM, and agentic AI are colliding — and the old world of network perimeters and endpoint controls can no longer keep up. Alex Bovee, CEO and Co-Founder of C1.ai and former security product leader at Okta, joins Lalit Choda (Mr. NHI) on the Non-Human and AI Identity Podcast to map out how we got here — from network-centric perimeters to endpoint security controls to identity as the new security control plane — and what the third generation of cybersecurity actually has to look like when AI agents are non-deterministic, goal-maxing, and completely without a moral compass. The conversation covers why visibility alone won't save you, why AI agents are already creating their own credentials and API keys without security guardrails, and why the only way to truly operate at machine speed is to let agents evaluate other agents — a mindset shift most CISOs and security leaders aren't ready for. ───────────────────────────────────── WHAT YOU'LL LEARN Why the first two generations of security — network security and endpoint security — have reached their limits Why identity security is the only control plane that works across human identities, non-human identities (NHIs), and AI agents Why AI agents are non-deterministic and non-trustable — and what that means for IAM and access control Why runtime authorization must replace orchestration-based identity governance and access management Why visibility into your NHI and machine identity estate is not enough without full lifecycle management Why agents evaluating other agents is an inevitable part of agentic AI security at machine speed How to think about the four control points for agentic workloads: harness, data and context, LLM inference endpoints, and credentials ───────────────────────────────────── KEY MOMENTS Introduction & Meet Alex [00:00–01:10] Mr. NHI's Human Identity in the Hot Seat [01:10–12:14] The 3 Generations of Security: Network, Endpoint, Identity [12:25–17:20] Why Identity is the New Cybersecurity Control Plane [17:20–20:20] From Orchestration to Runtime: The Shift That Changes Everything [20:20–23:05] NHI Technical Debt & Credential Lifecycle Management [23:05–30:25] Agents Evaluating Agents: The Machine-Speed Imperative [30:25–34:45] C1's Architecture: 4 Control Points for the Agentic Enterprise [34:45–40:10] Enabling AI Builders Without Compromising Zero Trust Security [40:10–43:05] C1 Transform — October 6th, San Francisco [43:05–46:30] Closing Thoughts for CISOs and Security Leaders [46:30–47:28] ───────────────────────────────────── RESOURCES NHI Knowledge Centre: nhimg.org C1: c1.ai C1 Transform: c1.ai/transform ───────────────────────────────────── #NHI #NonHumanIdentity #AIAgents #AgenticAI #IdentitySecurity #MrNHI #DigitalIdentity #IAM #ZeroTrust #RuntimeAuthorization #IdentityManagement #AgenticSecurity #Cybersecurity #MachineIdentity #CISO #CredentialSecurity #AccessManagement #IdentityGovernance #PAM #ServiceAccounts #APIKeySecurity #ArtificialIntelligence #AgentSecurity

Identity security was built for a human world — but AI agents are changing the rules. Henrique Teixeira, SVP of Strategy at Saviynt, answers 9 machine-speed questions on AI agents, NHI security, identity governance, the future of work, and the growing attack surface created by autonomous agents. ───────────────────────────────────── KEY TAKEAWAYS Identity security was built primarily around humans — and the world has changed Agentic AI security and NHI security aren't the same thing AI agents may behave more like employees than software AI agents could create and provision other identities as part of their productivity Organisations are deploying AI faster than they can govern it Generating AI content is cheap — validating it isn't The attack surface created by thousands of agents is being underestimated ───────────────────────────────────── CHAPTERS Introduction [00:00] Have We Built Identity Security for a World That No Longer Exists? [00:15] Does Agentic AI Security Equal NHI Security? [00:29] Do AI Agents Behave More Like Employees or Software? [01:14] Should AI Agents Be Allowed to Create Other Identities? [01:28] Will AI Agents Eventually Need to Be Fired? [01:49] Is IAM for AI More Important Than AI for IAM? [02:12] Are Organisations Deploying AI Faster Than They Can Govern It? [02:36] Will the AI Agent Digital Workforce Lead to Mass Unemployment? [02:44] Are We Underestimating the Attack Surface Created by Thousands of Agents? [05:47] ───────────────────────────────────── RESOURCES NHI Knowledge Centre: nhimg.org ───────────────────────────────────── From The Non-Human & AI Identity Podcast #CyberSecurity #NonHumanIdentity #IAM #AIAgents #IdentitySecurity #AgenticAI #ZeroTrust #DigitalIdentity #NHI #MachineIdentity #IdentityGovernance #CISO

Identity security was built for a human world — but that world is changing fast. Henrique Teixeira, SVP of Strategy at Saviynt and former Gartner analyst, joins Mr. NHI to discuss what the last decade of breaches has taught us, why identity remains the common denominator in the attack chain, and why organisations need to rethink how they approach NHI and AI identity. The conversation also explores the growing technical debt around API keys, service accounts and OAuth tokens, why AI security has become an undefined "goo" of overlapping categories, and why organisations should build a broader identity programme covering humans, NHIs and AI agents. ───────────────────────────────────── WHAT YOU'LL LEARN Why traditional identity security was built primarily around humans Why agentic AI security and NHI security aren't necessarily the same thing Why AI agents may behave more like employees than software Why organisations need to assume breach and focus on detection and recovery How decades of NHI technical debt are creating new attack opportunities Why identity remains a common denominator throughout the attack chain Why organisations should build one identity programme covering humans, NHIs and AI agents Why clear taxonomy matters in the increasingly confusing AI security market How runtime access control and intent-aware authorization could change AI security What the Hugging Face incident teaches us about NHI risk ───────────────────────────────────── KEY MOMENTS Introduction & Meet Henrique [00:00–03:11] Mr. NHI's Human Identity in the Hot Seat [03:11–09:42] Turning a Breach into a Case Study [09:42–14:35] Why Identity Is the Common Denominator in Every Attack [14:35–16:15] Why AI Security Has Become "Goo" [16:15–19:40] The NHI Technical Debt Problem [20:06–25:20] Building an Identity Programme for Humans, NHIs & AI [23:31–29:36] Saviynt's Zuma: Insights, Access & Governance [29:36–32:09] Runtime Authorization & Intent-Aware Access [32:10–34:23] The Hugging Face Lesson & Closing Advice [34:23–38:07] ───────────────────────────────────── RESOURCES NHI Knowledge Centre: nhimg.org Saviynt: saviynt.com ───────────────────────────────────── #cybersecurity #nonhumanidentity #iam #aiagents #agenticsecurity #agenticai #identitysecurity #zerotrust #digitalidentity #nhi #artificialintelligence #ai #ciso #machineidentity #Saviynt