Okta, partners push shared architecture and runtime controls for AI-agent identity

The coverage focused on how enterprises are putting AI agents to work while maintaining control over their access and actions. As agents call tools, delegate tasks and act across applications, the controls must follow those actions beyond an initial login, and they must work across systems while preserving the business processes the agents support.

Krista Case, principal analyst at theCUBE Research, said a central question is whether connected platforms produce conflicting insights about an action that needs to be taken. “For example, who is going to have the authority at the end of the day, and where is that authority going to live in this tech stack?” she said.

Okta executives, partners and customers discussed the issue during theCUBE’s coverage of Oktane. The Blueprint Alliance brings vendors together around a reference architecture intended to help customers secure environments where agents operate across systems, according to Charlotte Wylie, senior vice president and deputy chief security officer of Okta. “Rather than trying to solve that problem alone, there is a recognition that we have to galvanize as an industry to solve this problem for our customers at a speed that they are scrambling to run after,” she said. “We want to make sure that we provide an architecture, a referenceable position [for] how to use the technology that we all offer in a way that we can secure the entire agentic stack.”

Shared architecture also needs a point where controls can govern attempted actions. Okta’s move into the runtime path through its Agent Gateway expands the identity provider’s role from granting access to evaluating what agents seek to do, according to Ric Smith, president of products and technology at Okta. “That is a very different transition for Okta,” he told theCUBE. “We had not been inline, so with us moving in that direction, it means that we can do a lot more decision-making in terms of what we authorize.”

Inside Okta, that architectural challenge takes a practical form. Dex gives employees access to specialized agents without multiplying the interfaces they must navigate, according to Jenna Cline, senior vice president of technology, data and intelligence at Okta. “Dex can call upon the right sub-agent. That agent is scoped to only work on certain things, so it’s very secure, and it’s very efficient because it does one thing really well,” she said. “But Dex can do that for other agents; it can do that for the expense team [and] it can do that for our IT help desk.”

Securing AI agents requires cooperation beyond any single vendor. Okta and AgileBits Inc., doing business as 1Password, use shared identity standards to preserve an agent’s verified identity and authorization context. 1Password’s Credential Broker supplies secrets without exposing them to the agent or the underlying model, according to Nancy Wang, chief technology officer of 1Password. “Just like you would verify whatever an intern does before you allow them to move on to the next project, [it’s the] same thing with agents,” Wang told theCUBE. “You just want that agent to prove that it actually finished its last task with the right level of permissions, doing the right thing before you allow it to move on to the next task.”

That cooperation also matters when an agent’s behavior requires intervention. ServiceNow Inc. maps agents to the business processes they support and is working with Okta on agent identities and session tokens. Those connections inform decisions about when and how to contain an agent, according to Bhakti Pitre, vice president of AI platform security product at ServiceNow. “Everybody in the industry needs to come together and be each other’s friends or frenemies,” she said.