1Password Ties AI Agent Access to Individual Tasks, Rejecting Standing Privilege

Nancy Wang, CTO of AgileBits Inc., which does business as 1Password, said agents now log in, carry credentials and act on someone's behalf, giving them characteristics of both human and machine users. That overlap makes actions harder to attribute, because an agent can appear in an audit log as the person it works for even when software performed the action.

"Is it a machine? Is it a human? The right answer is [that] it's probably both," Wang said. "Which is why it makes it actually even more important to understand what is the identity this agent is acting as."

Wang made the remarks in an interview with theCUBE Research's Krista Case and co-host Rebecca Knight during an exclusive broadcast from the Oktane event on theCUBE, SiliconANGLE Media's livestreaming studio.

1Password rejects standing privilege for humans, machines and agents alike, according to Wang. Access is granted just in time and checked against the reason it is needed, an approach the company recently turned into a privileged access product scoped to a single task. She compared that check to the way an intern's work is verified before the intern is allowed to move on to the next project.

"You just want that agent to prove that it actually finished its last task with the right level of permissions, doing the right thing before you allow it to move on to the next task," she said.

Wang said 1Password and Okta are backing shared identity standards so that an agent's verified identity and authorization context can carry across the two companies' systems. The company's Credential Broker releases secrets only when they are needed and does not expose them to the agent or the underlying model.

She also argued that applications will increasingly become thin clients with most code written in remote sandboxes, which places secure access in the cloud. "I think that all of our apps are going to become thin clients and that most of the code will be written in remote sandboxes," she said. "Secure access needs to happen in the cloud."

TheCUBE is a paid media partner for Okta's Oktane event. Neither Okta, the sponsor of theCUBE's event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.

Editor's Summary

1Password is positioning AI agents as hybrid identities that should receive just-in-time access limited to a single task instead of standing privileges, with credentials withheld from both the agent and the model behind it. CTO Nancy Wang said the approach is needed because agents act on behalf of people while performing machine-driven actions, which complicates audit attribution. The company is also working with Okta on shared identity standards so authorization context travels between their systems.