How do bots authoritatively access your resources? The Ping Identity agentic access model documents one way to control access.
The ultimate guide?
Ping Identity wrote a page called “The Ultimate Guide to Identity for AI.” Ultimate? I guess a marketer wrote it.
Ping Identity notes that today’s agents are “navigating systems, initiating transactions, and making decisions—autonomously or under delegated authority.” Note that word “autonomously.” The system must control agentic access so we don’t get “agents gone wild” stories.
Controlling agentic access
To prevent such robotic debauchery, Ping Identity uses several mechanisms, including OAuth 2.0, DCR, mTLS, and assertion grants to control those pesky little bots. In addition, Ping Identity promotes four pillars of governance.
First: Delegate, don’t impersonate
You don’t want the agents to pretend they are humans and do whatever. Instead, the system issues “scoped, temporary tokens that clearly define what an agent is authorized to do, and on whose behalf.” So the system knows the human owner, and the authorizations that prohibit that expensive champagne purchase.
Second: Enforce least privilege
Just as least privilege is critically important when letting humans do and not do things, it’s also critically important for the bots. After all, authorizations apply to human and non-human identities alike (attribute based access control), and the system restricts them as needed.
Third: Maintain human oversight
We know this is important, but how do we do it? By designing systems that include humans in the loop. I’ve discussed that to death.
Fourth: Make every action auditable
Finally, make sure you know what everyone and everything did.
The risks are real
I don’t need to tell you that the risks of uncontrolled agents are real. Maybe they won’t launch World War III, but they can do plenty of damage. As Ping Identity reminds us, “Without clear identity and access boundaries, AI agents can become untraceable actors in systems that were never designed to govern or monitor them.”
That’s why Ping Identity and other vendors are implementing ways to control the new world in which humans and agents (hopefully) work together.
And old-timers such as me are adjusting to the new reality. If we don’t, we’re in trouble.
