Episode 225: Agentic Identity & AI Security — Then vs. Now

A lot has happened since Tanu's talk at Identiverse a few months back: "Runtime Identity: Trust at the Speed of AI". Although it's just been four human months, it's been four years in agent time. Agentic identity moved from prediction to urgent reality. New standards, vendor platforms, and real-world breaches confirm that AI agents need distinct identities, constrained delegation, external policy enforcement, and verifiable human intent. This episode compares what we expected with what happened—and identifies the next agentic security challenges.

#Speakers

• Host: Mike Schwartz, Founder/CEO Gluu
• Guest: Tanu Kaushik, Senior Manager IAM, ebay

#Homework

• Identiverse Talk "Runtime Identity: Trust at the Speed of AI"

#Takeaways

• Policy must live outside the agent. Zero Trust has required downstream enforcement for more than a decade. But that does not eliminate the need for endpoint policy—to constrain behavior, improve observability and detect threats earlier.
• Agent identity cannot simply copy human IAM. Ephemeral agents, delegation chains and mixed human-workload lifecycles demand a new model.
• You cannot govern what you cannot see. Runtime observability must connect intent, identity, delegation and the capabilities actually exercised.
• Like passkeys, by anchoring agent identity to a hardware secure enclave, we can eliminate shared secrets and reduce all the attack surface area that ensues.