Your New Employee Isn't Human!

Episode transcript

Transcript provided for accessibility and search. Minor transcription errors may remain.

Introduction

SPEAKER_00 0:05

This is AI Security Multipliers. AI, Cybersecurity Governance, with Steve. This week, your new employee isn't human. AI agents are starting to do real work inside the enterprise. They can access information, use applications, call APIs, make decisions, and increasingly take action without someone guiding every step. But if an AI agent is going to behave like a digital employee, there's a question we need to answer. Who gives it an identity? What should it be allowed to access? And when something goes wrong, who's responsible? To discuss what happens when your newest employee isn't actually human, here's Steve.

Your New Employee Isn't Human

SPEAKER_01 1:01

They can work 24 hours a day, they can read thousands of documents in seconds, they can work across dozens of systems simultaneously. They can send emails, update files, search databases, call APIs, use browsers, run processes, and increasingly make decisions. Frankly, they sound fantastic. There's just one slightly awkward question. Who gave them an account? Because we're entering a period where organizations aren't simply deploying AI. We're deploying AI agents. And once an AI can actually perform work, we've crossed an important line. This isn't just software anymore. It's becoming something much closer to a digital worker, which means cybersecurity has a new problem. We spent decades figuring out how to manage human identities. Then we spent years figuring out machine identities. And now we've got something in between. Something that can reason, something that can act, something that can use tools, something that can potentially delegate work to something else. And I'm not convinced most organizations have really thought through what that means. I'm Steve, and this is AI Security Multipliers. Today we're talking about your newest employee, the one who isn't human. Now,

We've Seen Machine Identities Before

SPEAKER_01 2:06

before somebody sends me a message saying, Steve, service accounts have existed for decades. Yes, I know, and you're absolutely right. We've had non-human identities for a very long time. Service accounts, application accounts, API keys, certificates, workloads, bots, automation platforms, robotic process automation. And of course that one service account created in 2009 that apparently runs half the company, and nobody is quite brave enough to disable. We know that one. But AI agents introduce something different. Traditional automation is generally deterministic. We tell it, do this, then this, then this. If this happens, do that. The workflow is relatively predictable. An AI agent can be given an objective instead. Prepare me for tomorrow's customer meeting. Investigate this security alert. Resolve these support tickets. Find overdue invoices and follow up. Review these contracts. Fix this vulnerability. The agent then works out how to accomplish the objective. It may choose tools, search information, make decisions, we'll call APIs, interact with applications, potentially ask another agent for help, and increasingly take actions without a human approving every individual step. That's incredibly powerful. It's also quite different from a service account, because we're combining identity, access, and autonomy. And that combination changes the security conversation.

Who Is the Agent?

SPEAKER_01 3:25

Let's start with what sounds like a ridiculously simple question. Who is the agent? Not what model is it running, not whether it's GPT, Claude, Gemini, or something else. Who is it? What identity does it have? Because if an agent is going to perform meaningful work inside an enterprise, I don't want it hiding behind my identity. And I definitely don't want 500 agents sharing some enormous service account called AI Prodi Admin. With a password nobody has changed since Christmas. If an agent performs an action, I want attribution. I want to know which agent did it, who created that agent, who owns it, what identity did it use? What permissions did it have? What information did it access? What action did it perform, and why? This is where identity becomes absolutely fundamental to a genic AI. An agent needs an identity. That identity needs permissions, those permissions need boundaries. Those boundaries need monitoring. And somebody needs accountability. Because once an agent can perform actions, identity isn't simply authentication anymore. Identity becomes the control plane for AI. And

The Delegation Problem

SPEAKER_01 4:24

then things get more interesting. Let's say I have an AI agent, we'll call him Bob. Bob is my research agent. I ask Bob to prepare a report. Bob decides he needs financial information. So Bob delegates part of the task to another agent. Let's call her Alice. Alice can access the finance system. Alice retrieves the information and sends it back to Bob. Bob then uses that information to create my report. Excellent. Very efficient. Except what exactly just happened to the permissions? I didn't have access to the finance system. Bob didn't have access to the finance system. Alice did. So should Bob now be allowed to receive the information Alice retrieved? Should I? What happens if Alice delegates something to another agent? And that agent calls another tool? Suddenly our nice little authorization model starts looking rather more complicated. Because we're no longer simply asking, does Steve have permission to access this? We're asking, does this agent have permission to perform this action? On behalf of this user, for this purpose, using this information through another agent? That's quite a sentence. Since somewhere an identity architect has just quietly closed their laptop and gone for a walk. But this is exactly where we're heading. Agent-to-agent delegation introduces chains of authority, and if we don't design those chains carefully, privilege can propagate in ways nobody intended. The principle of least privilege becomes even more important. But we may also need something else. Least agency. Not simply what information can this agent access? But what is the minimum amount of autonomy this agent needs to accomplish its job? That's a governance question I think we're going to be asking a lot. There's another

Your Org Chart Is About to Get Weird

SPEAKER_01 5:55

problem. How many agents are we actually talking about? Because I don't think organizations are going to have twelve AI agents. I think they're eventually going to have thousands, possibly tens of thousands. Employees will create them. IT will create them. Cybersecurity will create them. Vendors will embed them in products. SaaS platforms will create them. Business units will build specialized agents. Agents may even create or invoke other agents. And suddenly the identity population of the enterprise looks very different. Imagine an organization with 50,000 employees and 200,000 AI agents. Which ones still exist? Which ones are active? Which ones haven't been used for six months? Which ones have privileged access? Which ones can access customer data? Which ones can send email externally? Which ones can execute code? Which ones can spend money? Which ones belong to somebody who left the company eight months ago? And here's the particularly uncomfortable question. Which ones don't you know about? Because we already have shadow IT, then we got shadow AI. The next problem is shadow agents. Someone connects an AI tool to a corporate SaaS platform. They give it an API key. They connect an MCP server. They give it access to some documents. They automate a workflow. It works brilliantly. Everyone is delighted. Six months later the employee moves to another department, the agent is still there. Still running, still authenticated, still accessing information. Congratulations. You've invented the world's most enthusiastic orphan account. For human

The Joiner, Mover, Leaver Problem

SPEAKER_01 7:20

identities, we've spent decades developing life cycle processes. Someone joins. They receive access, as they change roles, their access changes, they leave, their access gets removed. At least that's how it's supposed to work. Let's not inspect that too closely. But what does life cycle management look like for an AI agent? An employee creates an agent. Who owns it? The employee? The manager? The department? IT? The company? What happens when that employee changes jobs? Does the agent move with them? Does its access change? What happens when they leave? Does the agent get disabled automatically? What if other employees now depend on it? What if other agents depend on it? What if it's running a critical business process nobody realized was critical? This is why agent inventory is going to become essential. Organizations are going to need to know what agents exist in exactly the same way they need to know what users, applications, devices, and workloads exist. Every agent should have an owner, a purpose, an identity, an approved set of tools, defined permissions, a risk classification, logging, a life cycle, and an exploration process. That sounds rather boring compared with autonomous artificial intelligence. Good. Boring controls are usually what stop exciting technology becoming an exciting incident. Now let's

What Happens When the Agent Goes Rogue?

SPEAKER_01 8:34

deal with the phrase everyone loves. Rogue AI. I'm not talking about Skynet, I'm talking about something considerably more mundane. An agent misunderstands an instruction, an agent is given a badly written objective, an agent receives malicious information through prompt injection. An agent calls the wrong tool. An agent gets stuck in a loop. An agent sends information somewhere it shouldn't. An agent starts making changes and nobody expected. What do you do? With a human employee, eventually somebody can walk over and say, Dave, stop. We need the equivalent for agents. Organizations need a kill switch. And preferably one slightly more sophisticated than unplugging the data center. Security teams need the ability to suspend an agent's identity, revoke credentials, terminate sessions, block tool access, stop execution, quarantine activity, and investigate what happened. Quickly. Because an autonomous agent operates at machine speed. If it can make one bad decision, it can potentially make a thousand bad decisions before somebody has finished opening the incident ticket. This is where zero trust becomes incredibly relevant. Never trust, always verify. Least privilege, continuous evaluation. Those principles work remarkably well for AI agents. Don't give an agent permanent broad access, because it might need something eventually. Give it the minimum access necessary, for the minimum period necessary, for the specific task being performed, and keep evaluating whether what it's doing still makes sense. Zero Trust wasn't invented for AI, but AI may turn out to be one of the best reasons we've ever had to implement it properly.

Security Cannot Be the Department of No

SPEAKER_01 10:04

Now here's the danger. Cybersecurity sees all of this and responds, nope, no agents, no autonomous actions, no external tools, no MCP, no browser control, no API access, no fun. Problem solved, and except it isn't. Because employees are going to use these capabilities. Businesses are going to want the productivity. Vendors are going to build agents into applications. And your competitors are going to adopt them. So simply banning a genetic AI isn't a strategy. It just guarantees that your agent problem becomes a shadow agent problem. Security's job isn't to stop the organization using AI agents. It's to make using them safely easier than using them unsafely. Give people approved platforms, approved models, approved connectors, approved tools, clear patterns, good identity integration, logging, monitoring, and sensible guardrails. Make the secure path the easy path, because if your approved AI process requires three committees, 17 forms and a six-week architecture review, someone is going to build the thing with a credit card on Tuesday afternoon. And cybersecurity will discover it during an incident six months later. That's not governance, that's archaeology. And

We're Creating a Digital Workforce

SPEAKER_01 11:11

I think this is the bigger point. We're not simply deploying another generation of software. We're beginning to create a digital workforce. Not because AI agents are people. They're not. But because increasingly they're going to occupy a similar operational position. They'll have identities, roles, responsibilities, permissions, managers, tools, objectives, activity histories, and eventually perhaps performance metrics. Some agents will be temporaries, some will be permanent, some will be highly privileged. Some will perform tiny repetitive tasks, some will coordinate other agents, and some will become deeply embedded in critical business processes. That means organizations may eventually need something that looks surprisingly similar to workforce governance, except for machines. Imagine the organizational chart. Manager Steve, three direct reports, and 17,000 AI agents. Performance review season is going to be fantastic. But underneath the joke is a serious architectural change. For decades, cybersecurity has largely assumed humans initiate business activity and systems execute it. Agentic AI starts breaking that assumption. Machines can increasingly initiate activity themselves, and our governance models need to catch up. So here's this episode's multiplier. Don't start by asking, how

The Multiplier

SPEAKER_01 12:30

do we secure AI agents? That's too broad. Instead, pick one agent your organization already has or is currently considering. Then treat it exactly as though you're onboarding a new employee. Ask, what is its job? Who owns it? What identity does it have? What systems does it need? What information can it access? What actions can it perform? What actions require approval? Can it delegate work? Can it communicate externally? What gets logged? Who reviews its access? How do we disable it? And what happens when we no longer need it? If you can't answer those questions, the agent probably isn't ready for production. And here's the multiplier. Once you've answered them for one agent, turn those answers into your standard. Because very soon you're not going to be governing one AI agent, you're going to be governing thousands of them. AI agents could become one of the biggest productivity changes

Closing

SPEAKER_01 13:22

we've seen in enterprise technology. I genuinely think that. They can remove enormous amounts of repetitive work, coordinate information, operate systems, handle routine decisions, and allow people to spend more time on work that actually requires people. That's exciting, but autonomy without identity is dangerous. Identity without governance is dangerous. And governance without visibility is mostly theatre. So as your organization starts experimenting with agents, don't just ask what they can do. Ask who they are. Give them an identity. Give them an owner. Give them boundaries. Monitor what they do and make sure you know how to fire them. Because your next employee might not be human, but they still need an access review. I'm Steve. This is AI Security Multipliers. And remember, AI should multiply your capability, not your mistakes. I'll see you next time.