Security1 publisher2 min readPublished
A Ping-sponsored paper would tie every AI agent to a named human owner
Martin Kuppinger of KuppingerCole argues role-based access cannot hold an agent that makes probabilistic, multi-step decisions, and wants per-session credentials plus logs recording what the agent was told to do.
The Watch · Security desk
What happened
- A KuppingerCole argument published on scworld holds that agents cannot be governed by traditional IAM because they make probabilistic decisions across dynamic, multi-step tasks.
- It calls for every agent to get a unique stable identifier tied to an accountable person or team, plus an authorized purpose, operational scope, list of permitted systems and expected lifetime.
- Martin Kuppinger, in a white paper sponsored by Ping Identity, argues policy-based access control beats role-based control because it weighs data sensitivity, threat level, task scope and autonomy per action.
- Agent credentials should be short-lived and issued per session or task rather than held as persistent secrets, with rotation and revocation automated.
- Every API call, data access and consequential action should land in immutable logs that record what happened and what the agent was told to do and why.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure An unregistered agent cannot be shut down during an incident: no named team is on the hook and no scope has been agreed to revoke.
- constraint Credentials that die with the task shorten the period a stolen agent secret is worth anything, so an attacker has to be present while the task runs instead of banking a secret for later use.
- decision Tiering forces an organization to name in advance which operations an agent completes alone and which stop for human approval; deploy first and tier later leaves high-risk actions running unsupervised.
- cost A log of what the agent was instructed to do has to be produced by the agent, since resource-side access logs cannot know intent. The builder of the agent pays for the instrumentation.
A service account is authorized once, at issuance, and keeps that grant until someone revokes it. Traditional IAM can work that way because it assumes users and applications, non-human identities included, stay inside relatively predictable boundaries [1]. The claim in the scworld piece is that an agent reasoning through a problem, chaining API calls across several systems and adapting its own actions without approval at each step breaks that assumption [2], so authorization has to be re-decided every time the agent attempts an action [3].
Counted out, the record proposed for each agent runs to six fields [16]. The accountable person or team is the field that gets used during an incident. Without it, the agent sits outside normal governance as a shadow resource, with no owner to call and no agreed scope to pull [7].
Kuppinger states the tiering principle directly. "Authorization decisions for AI agents should reflect the nature of the operation being performed," he wrote [10]. "Defining these tiers explicitly, rather than assigning a single set of permissions to all agents, limits the potential damage from a misbehaving or compromised agent," he wrote [11]. His example is specific: a routine read against a low-risk system proceeds on its own, while an attempt to modify financial records stops for additional checks or human approval [9].
APIs and resources have to enforce access policy themselves, and cannot take the agent's word for it [14]. Enforcement that lives inside the agent fails the moment an attacker influences the agent's decisions, because the same input that steers behavior then steers permissions.
The article argues from principles and does not cite incident data or a measured rate of agent failures, and the white paper it draws on is sponsored by Ping Identity [6][17]. Much of what it asks for is standing practice for machine identities already: credentials scoped to a session or task, automated rotation and revocation, policy enforced at the resource [8][14]. Kuppinger's audit argument is the part aimed outside the security team. "Regulators and auditors increasingly expect organizations to explain decisions made by automated systems," he wrote [13].
What to watch
- Whether the full Kuppinger white paper carries measured agent incident data or only the framework.
- Whether any identity vendor ships per-task credential issuance for agents with revocation that lands mid-task.
- Whether auditors begin asking for agent decision logs, including the instruction, in real engagements.