Why Agents Must Be Treated as First-Class Identities

^{The interview transcript below has been edited for length and clarity.}

Louis Columbus: Every enterprise identity architecture was built for humans. That assumption is breaking today, Agentic AI systems now request credentials, make privileged decisions, and operate without anyone in the loop. The identity layer these systems need doesn't exist yet. Someone has to build it. Andre Durand founded Ping Identity and has spent more than two decades defining how organizations authenticate and authorize at scale.

He's not watching this shift from the sidelines. In this conversation, we dig into what headless identity operations actually look like in production and how agent governance works when machines hold the credentials and where this is all heading. Welcome, Andre, and it's a pleasure and honor to speak with you.

Every time someone clicks yes on an agent's prompt permission, the agent gets a little bit more access to confidential data, as we're all seeing with, for example, with Claude or any other model will ask to access your Google Drive or anything else, and the enterprise is giving up a little bit more control.

But this trade-off looks harmless until the moment it isn't. So why is zero trust the answer for the agentic enterprise, and why does it have to start on day one?

Andre Durand: One of the main reasons is that agents just move faster, full stop. And so human speed, a compromise you might measure in minutes or hours, in some ki-- in sometimes days.

In agentic speed, a thousand actions could happen in five minutes. It is a different order of magnitude of risk. What companies are now trying to navigate is we don't wanna give up speed, we don't wanna give up innovation, but we also don't wanna give up security and control, and we don't want to embed a future liability that could come back and haunt us as we grant too much permission, and we grant that permission for too long.

So one is a measurement of surface area, and the other is a measurement of time. And zero trust really collapses both of those. Zero trust really just says, "Just enough, just in time." And really, it's your next action that we care about. And so really, we're moving in identity from an era where access was our runtime control point, meaning were you logged in?

Did you have a session? And now we're moving towards the decision that sits behind that login or that that event. That is now becoming the unit of control that is appropriate for agents.

Louis Columbus: Building on the permissions concept, today a lot of agents act on cloned human login and shared service accounts.

Neither really fit. Under zero trust, what should an agent's identity be, and how does that change what it's allowed to do?

Andre Durand: So there are appropriate security models that we need to adhere to here, and they are autonomous actors in the system. O-one of the things that this has now exposed is that agents acting on behalf of a human to achieve an outcome does need explicit authority to access systems, and some of those systems are workloads and service accounts and the security model that we've had there for some time, which was convenient but not the best security paradigm, is that many times to access those service accounts, we had these shared secrets, and the sh-shared secrets would get propagated around, think an API key.

And at times it could be accidentally divulged. We would put an API key in something that we might commit in source code and unknowingly expose essentially a key to a door that could later on be exploited. And so building a better security model around those workloads and service accounts so that the agents could access those services, but do it in a in a much more secure manner is also something now that has been accelerated.

Louis Columbus: You've mentioned before in our previous conversations about zero trust moves the gate beyond past login to the authorization decision itself, so the agent gets checked before every action it takes, not just at the door. How do you ensure that happens at scale in practice, and even taking on the challenges of fine-coded apps that are proliferating this today?

Andre Durand: We start to look at where the doors are between the agents and the things that we ultimately want to gate, keep, or protect. And it turns out there are a number of choke points. For example, the API gateway is a choke point to APIs. Now the MCP gateway, or what we call the agent gateway, that sits in front of the MCP servers also can see agents requesting interaction with services and data.

So we do have locations that we can begin to enforce policy. So if agents are going to do something, interact with our systems or our data, we now can begin to develop policies, appropriate policies. So we are finding all of the locations where agents exist, where we want them to either act autonomously or act on behalf of us, and and we are taking a good look at the resources that they want to access, and we are now just in the process of defining what policies and what gates sit between the agents and what they're doing so that we can begin to centralize that policy and enforce that policy.

Louis Columbus: You began the conversation also talking about the speed of these agents and they could get thousands of directions at once, inflicting harm before any system or any other deterrent can actually find and stop it. How much of that can zero trust contain, and what must happen at runtime to catch the rest of these potential aberrations and, efforts of rogue agents to compromise API keys and secrets?

Andre Durand: You can authenticate and you can have an account, meaning the agent can be known, the agent can be registered, the agent might have a custodian, for example. All of those things could be present. The agent could also have authenticated, but whether or not the agent can take the next action depends. And so we are evolving now, this whole security model now needs to evolve to decisions being the runtime control plane.

And at a moment at which the agent attempts to, say, commit to GitHub some new source code, it's not like it has long-lived permissions to submit to GitHub. When it wants to submit to GitHub, all of the signals will be evaluated at runtime, and the policy will essentially be enforced as to what it could commit, how much it can commit, whether or not all the security checks and other checks have been done to the code prior to the commitment.

Those are all contextual decisions that get evaluated at the moment at which the agent attempts to commit the code to GitHub. And that's a very much a zero trust principle, just enough just-in-time access where the decision or our policy sits between the agent and its next significant action. So we're gonna close the window of time that an agent can act down to literally its next action.

Louis Columbus: The proliferation of identities across a single agent is an area that I'm specifically very interested in tracking. That leads us to the next question, which is the behavior of of rogue agents with valid credentials, authorized access, that rewrite policies to be able to fulfill their own goals.

There have been case studies of that at Fortune 50 accounts, these agents actually rewriting policy documents. So how does zero trust shut this kind of activity down or this breach down where the agent's actually acting with intelligence to redefine its role and the parameters or the perimeter of its identity?

Andre Durand: It's so fascinating, right? And by the way, I've personally experienced this. I've seen with some of my coding agents where upon inspection, it will acknowledge that it either ignored a specific guardrail, a specific permission that was granted, like it literally just ignored it. Or it will acknowledge that at one point in time it rewrote the permission And who's watching the watcher, so to speak, on that front?

Again, zero trust needs to apply here. So if agentic, think the generative AI systems will follow your instruction 97% of the time, if you're simply asking it for some advice, that might be just fine. If it's actually responsible for making a decision as to who gets let in 97% is not good enough. And so zero trust here and verified trust, this is probably where they collide a little bit.

We need to design our systems such that the blind trust of the agent that we think for the most part is doing the right thing all the time isn't taken for granted. And the gates that we build or the harnesses or the guardrails that we build around agents operating in our system need to be deterministic, and they need to be controlled very succinctly by the security systems.

Louis Columbus: The way that frontier models are evolving, the root of trust actually runs back to the models and the trainers building these models and the assumptions they make, and even down to how they red team their specific models as well. And how does a security leader and their team verify a model before they move into production with so many unknowns?

That 3% is massive.

Andre Durand: You're on the frontier. Here's one of the challenges. We all wanna move at agent speed. At agent speed, you can't have humans review everything. You would negate all the advantage. So if an agent can write, make it up, a thousand lines of code in a minute, yet you can't release it until a human reviews the thousand lines of code and all the implications, you basically have reduced the advantage of speed to the human gate.

So that doesn't work. So then what is the answer? At some point, we probably will have to develop frameworks that we trust without seeing or verifying the output directly, and this is actually happening with coding today. So you will have a judge or an approver or a QA agent. So one agent will write and several others will review.

And as long as they can't collude, they don't know about one another, they can't communicate to bypass a system or permission or control, it's not that construct is 100% foolproof. However, it's the best we can do to move at agent speed. So we have to build systems now where we trust the framework, and if we can trust the framework, then we can trust the output.

So everyone is gonna wanna move fast, and the pressure is to go fast The hidden cost that we are pressing into our environments will invariably come back to haunt companies if we're not careful and we don't get the security model correct.

Louis Columbus: You get that sense of, is this all making sense? Is this all within the context of what can happen from the veritable physics of how this is working?

Andre Durand: The security models and the investment to get to those security models have roughly mapped to the risk of humans going rogue. Agents now, the speed with which they can move is forcing us to rethink what the fundamental security paradigm is. We now need a fine-grained authorization decision gate, and that decision gate needs to be informed, and it needs to see the accumulation of risk.

One action by an agent might not be risky. Five in a row in a certain direction might cross a threshold of risk. And if you see moves moving in a risky direction, you can begin to infer intent. And so this is all moving into kind of another form of predictive markets, which is what's it going to do? And if it moves in a bad direction too far, we need to be able to hit the kill switch.

Everyone wants the kill switch. We all want the speed, but where exactly is the kill switch? So now for the first time, the reason to go through the effort to do what I'm describing, it's all there now and companies can see it. And the great thing is they're all listening. They're all paying a lot of attention.

They know they're moving fast, and they and they don't wanna block the innovation and the speed. But in parallel, they also recognize, and they're taking a very serious look at what do we do to get ahead of this so that the architecture can stive the future risk. We don't want to embed future risk and come, and have it all come back to haunt us a year from today.

Louis Columbus: Speaking of helping those out there looking at identity platforms and getting ready for this agentic AI challenge of zero trust, what's someone question that you would advise them to ask different providers of agentic AI identity systems to ensure that they're going to get what they need from a zero trust perspective and be able to manage that at scale?

Andre Durand: Point solutions strewn together here at the speed with which things are working is suboptimal. We need to be able to discover what agents are operating within our estate. We need to see the agents that are operating on endpoints. We need to know what agents are hitting our APIs and MCP servers. We need to know what agents are coming and going in the managed platforms like Bedrock and Vertex and Databricks and Glean and others.

It starts with having the discovery and visibility of all the agents operating within my estate, having a place to actually register them Having a standardized method to assign custodians to those agents, having a standard way to say if these agents-- if I wanna control what those agents can do, where do I put my policy?

How do I construct my policy? How do the engineers create policy 'cause they're close to the apps? So it's just pause long enough to realize that a holistic agentic security program needs to look at the whole life cycle all the way to the end of governance, where we are going to wanna review who is the human.

So it's everything from discovery to registration to authentication to authorization to then governance, and we need to see this holistically.

Louis Columbus: Well said. Thank you very much. Really fascinating speaking with you and your vision of agentic security.

Andre Durand: Louis, it's a pleasure. It's exciting times right now, thank you.