Vanderbilt University extends identity governance to AI agents

Vanderbilt uses OneVU, powered by Okta, for single sign-on. Its broader environment includes residential life, athletics, its own police department and more than $1 billion in research. Callahan said that breadth complicates access decisions because people at a university can hold multiple identities, sometimes at the same time. “When it comes to [a] university, you could have multiple identities and sometimes at the same time,” he said. “For me, I’m a student, I’m a staff member, [I] could be a donor — all these different things — and they all have different profiles of how you work at a university. Keeping track of that security profile is very, very difficult.”

Callahan spoke with theCUBE Research’s Krista Case and co-host Rebecca Knight at Okta’s Oktane event, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. The discussion covered changing identity requirements, AI agent accountability and cross-functional governance, according to SiliconANGLE.

Agents add another layer to identity security. Distinct identities and scoped access can limit what agents do, but they do not resolve who bears responsibility for their actions, Callahan said. “If you have an agent that does something and it goes outside of your guardrails, are you accountable for that or is the tool accountable for that?” he said. “What happens if that tool gets out of guardrails and impacts another group or another company? Does cyber insurance help us with that? We don’t understand where liability or responsibility falls at this point.”

Organizations do not need to discard established oversight mechanisms to address those risks, Callahan said. Identity governance can build on existing technology-intake processes and cross-functional governance. “We’re treating AI like it’s a brand-new thing. But really, you’re still talking about identity data in another technology tool,” he said. “You don’t have to recreate everything. If you have a governance process and a technology intake program, do that, use that.”

The interview was part of SiliconANGLE’s and theCUBE’s coverage of Okta’s Oktane event. TheCUBE is a paid media partner for the event, and neither Okta nor other sponsors have editorial control over content on theCUBE or SiliconANGLE, according to the report.

Editor's Summary

Vanderbilt University CIO Shane Callahan said at Okta’s Oktane event that the university is extending identity governance to AI agents. He pointed to the difficulty of managing multiple university identities and unresolved questions about liability when agents act outside guardrails. Callahan argued that institutions can use existing technology-intake and cross-functional governance processes rather than rebuilding oversight from scratch.