AI agent governance takes shape at Okta’s Oktane event

AI agent governance moves identity security into the workflow. As agents access tools, delegate tasks, and act across applications, organizations need controls that track these actions beyond an initial login. The challenge is ensuring that these controls work across systems while maintaining agent support of business processes.

The limitations of individual security platforms were a recurring issue during Okta Inc.’s Oktane event. According to Krista Case, principal analyst at theCUBE Research, organizations face questions beyond granting or revoking access as agents operate across networked systems.

“What I’m interested in as it rolls out and we start talking to customers about it is whether there are conflicting insights across these platforms about an action that needs to be taken,” she said. “For example, at the end of the day, who will have the authority and where will that authority live in this tech stack?”

Case and co-host Rebecca Knight spoke with Okta executives, partners and customers during theCUBE’s coverage of Okta’s Oktane event, broadcast exclusively on theCUBE, SiliconANGLE Media’s livestreaming studio. Discussions explored how companies deploy AI agents while maintaining control over their access and actions. (*Disclosure below.)

Here is the full video keynote analysis with Krista Case and Rebecca Knight:

Here are three takeaways you may have missed from theCUBE’s coverage of Okta’s Oktane event:

Insight #1: AI agent governance requires common architecture and runtime controls.

An agent’s work can span applications and security platforms, so consistent protection depends on how these systems are connected. According to Charlotte Wylie (pictured), Okta’s senior vice president and deputy chief security officer, the Blueprint Alliance brings together vendors around a reference architecture to help customers secure this environment.

“Rather than trying to solve this problem alone, there is a recognition that we must mobilize as an industry to solve this problem for our customers at a pace they can’t wait for,” she said. “We want to make sure we provide an architecture and a referenceable position [for] how we can leverage the technology we all offer to secure the entire agent stack.”

A common architecture also requires a point at which controls can guide attempted actions. According to Ric Smith, president of products and technology at Okta, Okta’s move into the runtime path through its Agent Gateway expands the identity provider’s role from granting access to assessing what agents want to do.

“This is a very different transition for Okta,” he told theCUBE. “We haven’t been inline, and moving in that direction means we can make a lot more decisions about what we approve.”

At Okta, this architectural challenge takes a practical form. According to Jenna Cline, senior vice president of technology, data and intelligence at Okta, Dex allows employees to access specialized agents without multiplying the interfaces they must navigate.

“Dex can rely on the right sub-agent. That agent is limited to only doing certain things, so it’s very safe and very efficient because it does one thing really well,” she said. “But Dex can do that for other agents; it can do that for the expense team [and] This is what it can do for our IT help desk.”

Here is theCUBE’s full video interview with Jenna Cline:

Insight #2: Securing AI agents requires collaboration beyond individual vendors.

The control of AI agents depends on access decisions that are transmitted across systems. Okta and AgileBits Inc., operating under the name 1Password, use common identity standards to preserve an agent’s verified identity and authorization context. According to 1Password Chief Technology Officer Nancy Wang, 1Password’s Credential Broker delivers secrets without revealing them to the agent or underlying model.

“Just as you would check what an intern is doing before allowing them to move on to the next project, [it’s the] “The same goes for agents,” Wang told theCUBE. “You just want that agent to prove that they actually completed their last task with the right level of authority and did the right thing before you allow them to move on to the next task.”

This collaboration is also important when an agent’s behavior requires intervention. ServiceNow Inc. maps agents to the business processes they support and works with Okta on agent identities and session tokens. These connections influence decisions about when and how to contain an agent, according to Bhakti Pitre, vice president of AI platform security products at ServiceNow.

“Everyone in the industry needs to come together and be each other’s friends or enemies,” she said. “If AI needs to be so big that it is democratized so that everyone can use it, then all providers need to come together and do their part.”

Here is theCUBE’s full video interview with Nancy Wang:

Insight #3: Simpler infrastructure and established governance form the foundation for AI agents.

The Professional Golfers’ Association of America relies on Okta and Auth0 as part of an architecture that has eliminated traditional infrastructure layers, including data centers and an enterprise network. According to Kevin Scott, chief technology officer of the PGA of America, these decisions help direct resources toward technologies that serve members and customers.

“We don’t have a big team – it’s small, it’s lean,” he told theCUBE. “I don’t want to reduce it, but if we spent half the technology budget on managing systems, none of our customers would ever come along and say, ‘Thank you very much for that’.”

At Vanderbilt University, the focus is on applying established governance to AI agent identities. According to Shane Callahan, Vanderbilt’s chief information officer, the university is using OneVU, powered by Okta, for single sign-on and is considering how institutional oversight should consider a different type of identity.

“We treat AI like it’s something completely new. But in reality you’re still talking about identity data in another technology tool,” he said. “You don’t have to rebuild everything. If you have a governance process and a technology adoption program, do that and use it.”

Here is theCUBE’s full video interview with Kevin Scott:

To see more of theCUBE’s coverage of Okta’s Oktane event, check out our full video playlist here:

https://www.youtube.com/watch?v=videoseries

(*Disclosure: TheCUBE is a paid media partner for Okta’s Oktane event. Sponsors of theCUBE’s event coverage have no editorial control over theCUBE or SiliconANGLE content.)

Photo: SiliconANGLE