The Non-Human & AI Identity Podcast

Can you still trust your non-human identities (NHIs) once AI agents start making their own decisions? We used to trust service accounts and workloads because they behaved predictably. Autonomous agents don’t, and that changes how identity security, least privilege and authorization need to work.At Agentic IAM Day 2026, hosted by PlainID, Lalit Choda (Founder & CEO of NHI Mgmt Group, known as Mr. NHI) put two very different viewpoints in the same room. Steven Rennick (Senior Leader, Identity Strategy & Architecture, Ciena) speaks as the enterprise architect who has to make agent trust work in practice. Dror Zelber (VP, AI Product Marketing, Radware) has watched agents go off-script in the wild and argues we should treat them like humans. Together they ask whether our NHI “friends” are turning into insider threats, and why every agent should start with zero privilege.What you’ll learn:Why trust based only on identity and permissions breaks down for AI agents, and what continuous, runtime trust looks likeTwo real ways agents become insider threats: indirect prompt injection, and forgotten or wider-than-expected permissionsHow least privilege has to change for autonomous agents: start with zero standing access and grant it just in time for each actionWhy monitoring agent behaviour against its stated goals and intent mattersWhether an AI agent is “just another NHI” or should be governed more like a humanWhy “machine-speed judgment” matters more than machine-speed authorizationChapters:(00:00) Introduction – Agentic IAM Day 2026(00:31) Friends or enemies? Rethinking trust in NHIs(01:30) Trust models for autonomous machine actors(02:48) When do NHIs become insider threats?(05:15) Least privilege for AI agents(07:28) Real-time authorization & behavioural monitoring(09:52) Is an AI agent just another NHI?(11:44) Treating every identity as a “digital actor”(13:23) Speed vs. judgment in agent authorization(15:15) Closing advice for your agentic AI journeyNHI Foundation Training: the only accredited NHI training programme in the industry. Learn how to manage and secure NHIs, including AI agents.Enrol here: https://training.nhimg.org/Learn more about NHI and AI agent security: https://nhimg.orgFollow us:LinkedIn: https://www.linkedin.com/company/non-human-identity-management-groupTikTok: https://www.tiktok.com/@mr_non_human_identity

AI Agents Have No Conscience — So Treat Them Like a Rogue EmployeeSameer Mehta, Chief Product Officer at Opal Security, answers 10 machine-speed questions on identity security, agentic AI, and how to secure a workforce that is no longer only human.🔑 Key Takeaways:We haven’t built identity security for a world that no longer exists — the problems are the same, but the scale and attack surface have changedCISOs are ready for the challenge, but perimeter, endpoint and cloud controls must be re-engineered for the agent eraIAM for AI and AI for IAM go hand in hand — at machine speed, you need agents reviewing agent accessAI agents are already in production without proper guardrails — standing access granted on “vibes” is going uncheckedAgentic AI security and NHI security aren’t the same thing — they share ownership challenges, but agents are purpose-driven in a way service accounts aren’tAgents behave more like software than employees — mission-driven, with no conscienceAgents should be allowed to create and provision other identities, as long as guardrails are enforced behind the scenesAgents will need background checks over time — maybe ID.me extends to agentsThe AI digital workforce won’t cause mass unemployment — humans will redefine their roles, and GDP will growWould Sameer trust an AI agent to make a decision affecting his own security? Yes — trust but verify.Sameer Mehta, Chief Product Officer at Opal Security and former product leader at Veza, faces Mr. NHI’s Human Identity in the Hot Seat — 10 machine-speed questions on IAM, agentic AI security, non-human identity, and the future of the digital workforce.From The Non-Human & AI Identity Podcast 🎙️⏱ Chapters:00:00 Introduction00:18 Have We Built Identity Security for a World That No Longer Exists?01:23 Are CISOs Ready for the Fleet of Autonomous Digital Employees?02:53 Is IAM for AI More Important Than AI for IAM?04:41 Are AI Agents Being Deployed Into Production Without Security Guardrails?06:09 Does Agentic AI Security Equal NHI Security?07:47 Do AI Agents Behave More Like Employees or Software?09:50 Should AI Agents Be Allowed to Create and Provision Other Identities?11:21 Do Agents Need Background Checks Like Humans?12:53 Will the AI Agent Digital Workforce Lead to Mass Unemployment?14:32 Would You Trust an AI Agent to Make a Decision Impacting Your Own Security?#CyberSecurity #NonHumanIdentity #IAM #AIAgents #IdentitySecurity #AgenticAI #ZeroTrust #DigitalIdentity #NHI #MachineIdentity #IdentityGovernance #CISO #LeastPrivilege #StandingAccess #AgenticSecurity #ServiceAccounts #PolicyAsCode #AccessManagement #OpalSecurity #MrNHI

Policy Enforcement for AI Agents: Why Human Approvals Can’t Keep UpAI agents are requesting access at machine speed, chaining MCP tool calls across ten or more applications and spawning sub-agents. Access policies built for humans waiting on approval tickets can’t keep pace.Sameer Mehta, Chief Product Officer at Opal Security and former product leader at Veza, joins Lalit Choda (Mr. NHI) on the Non-Human and AI Identity Podcast. He explains why policy enforcement for AI agents needs a new model. That model treats agents as mission-driven software with no conscience, combines fixed rules with AI-driven decisions, and stops granting standing access based on “vibes.”The conversation covers why agents are already reaching production without proper security guardrails, and how to keep policy as code predictable when the agents it governs are non-deterministic. It also covers how agent manifests expose off-purpose agents, and why access decisions only scale when an AI agent approves, denies or escalates them.What you’ll learn:Why identity security doesn’t need to be thrown away for agentic AI: the problems are the same, but the scale and attack surface have changedHow standing access piles up in production through judgment-call approvals, and why it goes unnoticedWhy AI agent security and NHI security share ownership challenges but are not the same thingWhy one-size-fits-all access policy breaks for agents, and how to set policy by identity type, resource sensitivity and agent lifespanHow to combine fixed rules and custom instructions with AI-driven access decisions so outcomes stay predictableHow agent manifests reveal off-purpose agents that stray beyond their declared MCP tool call chainHow to evolve policy from access-decision data: move routine requests to birthright access or auto-approval, and keep humans in the loop for privileged resources and break-glass accountsKey Moments:Introduction & Meet Sameer [00:00–03:15]Mr. NHI’s Human Identity in the Hot Seat [03:15–19:36]What Security Teams Are Asking About AI Agents [19:36–24:16]Is Agent Risk Exposing the Wider NHI Problem? [24:16–25:52]Why Human-Era Access Policy Breaks for Agents [25:52–28:44]Building a Policy Model for Agents: Paladin & Policy as Code [28:44–32:32]Policy as Code vs Non-Deterministic Agents [32:32–36:43]Real-World Example: Custom Instructions & Human-in-the-Loop [36:43–40:00]From Humans to Agents: How Paladin & Opal 0 Evolved [40:00–45:01]Agent Manifests & Detecting Off-Purpose Agents [45:01–47:12]Upfront Policy vs Learned Policy [47:12–50:30]Advice for Security Leaders: Start, Measure, Iterate [50:30–51:50]Learn More About Opal & Closing [51:50–53:31]📚 NHI Knowledge Centre: nhimg.org🔗 Opal Security: opal.dev#NHI #NonHumanIdentity #AIAgents #AgenticAI #IdentitySecurity #MrNHI #DigitalIdentity #IAM #PolicyAsCode #PolicyEnforcement #AccessControl #IdentityGovernance #IGA #LeastPrivilege #JustInTimeAccess #MCP #AgenticSecurity #Cybersecurity #MachineIdentity #CISO #AccessManagement #PAM #ServiceAccounts #AgentSecurity #ArtificialIntelligence

AI Agents Are Non-Deterministic, Non-Trustable — and Already in Your Production EnvironmentAlex Bovee, CEO and Co-Founder of C1.ai and former security product leader at Okta, faces Mr. NHI's Human Identity in the Hot Seat — 10 machine-speed questions on IAM, agentic AI security, non-human identity, and the future of the digital workforce.─────────────────────────────────────KEY TAKEAWAYSIdentity security was built for humans using SaaS apps — that world no longer existsThe surface area of the enterprise has fundamentally exploded with agentic AIEveryone is a builder now — and the world is very, very messyIAM for AI is the bigger imperative over AI for IAMAI agents are being deployed into production without security guardrails — 100%Agentic AI security and NHI security aren't the same thingAgents are non-deterministic and non-trustable — unlike humans and unlike softwareAI agents already create and provision other identities — and that's not necessarily bad, but it needs control pointsThe insider threat has been amplified by agentic AI — UEBA is making a comebackWould Alex trust an AI agent to make a decision impacting his own security? No.─────────────────────────────────────CHAPTERSIntroduction [00:00]Have We Built Identity Security for a World That No Longer Exists? [00:18]Are CISOs Ready for the Fleet of Autonomous Digital Employees? [01:25]Is IAM for AI More Important Than AI for IAM? [02:47]Are AI Agents Being Deployed Into Production Without Security Guardrails? [04:08]Does Agentic AI Security Equal NHI Security? [04:16]Do AI Agents Behave More Like Employees or Software? [05:40]Do Agents Need Background Checks Like Humans? [08:21]Should AI Agents Be Allowed to Create and Provision Other Identities? [08:51]Will the AI Agent Digital Workforce Lead to Mass Unemployment? [09:24]Would You Trust an AI Agent to Make a Decision Impacting Your Own Security? [10:52]─────────────────────────────────────RESOURCESNHI Knowledge Centre: nhimg.orgC1: c1.ai─────────────────────────────────────From The Non-Human & AI Identity Podcast#CyberSecurity #NonHumanIdentity #IAM #AIAgents #IdentitySecurity #AgenticAI #ZeroTrust #DigitalIdentity #NHI #MachineIdentity #IdentityGovernance #CISO #RuntimeAuthorization #AgenticSecurity #ServiceAccounts #APIKeySecurity #InsiderThreat #AccessManagement #C1AI #MrNHI

Identity is the 3rd Generation of SecurityIdentity security, IAM, and agentic AI are colliding — and the old world of network perimeters and endpoint controls can no longer keep up.Alex Bovee, CEO and Co-Founder of C1.ai and former security product leader at Okta, joins Lalit Choda (Mr. NHI) on the Non-Human and AI Identity Podcast to map out how we got here — from network-centric perimeters to endpoint security controls to identity as the new security control plane — and what the third generation of cybersecurity actually has to look like when AI agents are non-deterministic, goal-maxing, and completely without a moral compass.The conversation covers why visibility alone won't save you, why AI agents are already creating their own credentials and API keys without security guardrails, and why the only way to truly operate at machine speed is to let agents evaluate other agents — a mindset shift most CISOs and security leaders aren't ready for.─────────────────────────────────────WHAT YOU'LL LEARNWhy the first two generations of security — network security and endpoint security — have reached their limitsWhy identity security is the only control plane that works across human identities, non-human identities (NHIs), and AI agentsWhy AI agents are non-deterministic and non-trustable — and what that means for IAM and access controlWhy runtime authorization must replace orchestration-based identity governance and access managementWhy visibility into your NHI and machine identity estate is not enough without full lifecycle managementWhy agents evaluating other agents is an inevitable part of agentic AI security at machine speedHow to think about the four control points for agentic workloads: harness, data and context, LLM inference endpoints, and credentials─────────────────────────────────────KEY MOMENTSIntroduction & Meet Alex [00:00–01:10]Mr. NHI's Human Identity in the Hot Seat [01:10–12:14]The 3 Generations of Security: Network, Endpoint, Identity [12:25–17:20]Why Identity is the New Cybersecurity Control Plane [17:20–20:20]From Orchestration to Runtime: The Shift That Changes Everything [20:20–23:05]NHI Technical Debt & Credential Lifecycle Management [23:05–30:25]Agents Evaluating Agents: The Machine-Speed Imperative [30:25–34:45]C1's Architecture: 4 Control Points for the Agentic Enterprise [34:45–40:10]Enabling AI Builders Without Compromising Zero Trust Security [40:10–43:05]C1 Transform — October 6th, San Francisco [43:05–46:30]Closing Thoughts for CISOs and Security Leaders [46:30–47:28]─────────────────────────────────────RESOURCESNHI Knowledge Centre: nhimg.orgC1: c1.aiC1 Transform: c1.ai/transform─────────────────────────────────────#NHI #NonHumanIdentity #AIAgents #AgenticAI #IdentitySecurity #MrNHI #DigitalIdentity #IAM #ZeroTrust #RuntimeAuthorization #IdentityManagement #AgenticSecurity #Cybersecurity #MachineIdentity #CISO #CredentialSecurity #AccessManagement #IdentityGovernance #PAM #ServiceAccounts #APIKeySecurity #ArtificialIntelligence #AgentSecurity

Identity security was built for a human world — but AI agents are changing the rules.Henrique Teixeira, SVP of Strategy at Saviynt, answers 9 machine-speed questions on AI agents, NHI security, identity governance, the future of work, and the growing attack surface created by autonomous agents.─────────────────────────────────────KEY TAKEAWAYSIdentity security was built primarily around humans — and the world has changedAgentic AI security and NHI security aren't the same thingAI agents may behave more like employees than softwareAI agents could create and provision other identities as part of their productivityOrganisations are deploying AI faster than they can govern itGenerating AI content is cheap — validating it isn'tThe attack surface created by thousands of agents is being underestimated─────────────────────────────────────CHAPTERSIntroduction [00:00]Have We Built Identity Security for a World That No Longer Exists? [00:15]Does Agentic AI Security Equal NHI Security? [00:29]Do AI Agents Behave More Like Employees or Software? [01:14]Should AI Agents Be Allowed to Create Other Identities? [01:28]Will AI Agents Eventually Need to Be Fired? [01:49]Is IAM for AI More Important Than AI for IAM? [02:12]Are Organisations Deploying AI Faster Than They Can Govern It? [02:36]Will the AI Agent Digital Workforce Lead to Mass Unemployment? [02:44]Are We Underestimating the Attack Surface Created by Thousands of Agents? [05:47]─────────────────────────────────────RESOURCESNHI Knowledge Centre: nhimg.org─────────────────────────────────────From The Non-Human & AI Identity Podcast#CyberSecurity #NonHumanIdentity #IAM #AIAgents #IdentitySecurity #AgenticAI #ZeroTrust #DigitalIdentity #NHI #MachineIdentity #IdentityGovernance #CISO

Identity security was built for a human world — but that world is changing fast.Henrique Teixeira, SVP of Strategy at Saviynt and former Gartner analyst, joins Mr. NHI to discuss what the last decade of breaches has taught us, why identity remains the common denominator in the attack chain, and why organisations need to rethink how they approach NHI and AI identity.The conversation also explores the growing technical debt around API keys, service accounts and OAuth tokens, why AI security has become an undefined "goo" of overlapping categories, and why organisations should build a broader identity programme covering humans, NHIs and AI agents.─────────────────────────────────────WHAT YOU'LL LEARNWhy traditional identity security was built primarily around humansWhy agentic AI security and NHI security aren't necessarily the same thingWhy AI agents may behave more like employees than softwareWhy organisations need to assume breach and focus on detection and recoveryHow decades of NHI technical debt are creating new attack opportunitiesWhy identity remains a common denominator throughout the attack chainWhy organisations should build one identity programme covering humans, NHIs and AI agentsWhy clear taxonomy matters in the increasingly confusing AI security marketHow runtime access control and intent-aware authorization could change AI securityWhat the Hugging Face incident teaches us about NHI risk─────────────────────────────────────KEY MOMENTSIntroduction & Meet Henrique [00:00–03:11]Mr. NHI's Human Identity in the Hot Seat [03:11–09:42]Turning a Breach into a Case Study [09:42–14:35]Why Identity Is the Common Denominator in Every Attack [14:35–16:15]Why AI Security Has Become "Goo" [16:15–19:40]The NHI Technical Debt Problem [20:06–25:20]Building an Identity Programme for Humans, NHIs & AI [23:31–29:36]Saviynt's Zuma: Insights, Access & Governance [29:36–32:09]Runtime Authorization & Intent-Aware Access [32:10–34:23]The Hugging Face Lesson & Closing Advice [34:23–38:07]─────────────────────────────────────RESOURCESNHI Knowledge Centre: nhimg.orgSaviynt: saviynt.com─────────────────────────────────────#cybersecurity #nonhumanidentity #iam #aiagents #agenticsecurity #agenticai #identitysecurity #zerotrust #digitalidentity #nhi #artificialintelligence #ai #ciso #machineidentity #Saviynt

What will the NHI and agentic AI security landscape look like over the next 24 months?In the final panel from the NHI & AI Identity Summit at Identiverse 2026 (IDV 2026), industry leaders make predictions about where Non-Human Identity and agentic AI security are heading — and which identity and security controls may struggle as autonomous systems scale.The discussion explores autonomous agents, delegation chains, ephemeral identities, emerging attack paths, regulation, governance, shared signals and the growing need for visibility across agentic environments.Speakers:Lalit Choda — CEO & Founder, NHI Mgmt GroupAmir Ofek — Co-Founder & CEO, AizomeEve Maler — Founder, Venn FactoryJohn Yeoh — Chief Security Officer, CSAWhat You’ll Learn:• Where NHI and agentic AI security could go over the next 24 months• Which identity and security controls may break first as agents scale• How autonomous and ephemeral agents change identity lifecycle management• Why delegation chains and agent-to-agent interactions create new risks• How regulation and liability may evolve around AI systems• Why visibility and inventory are foundational to governing agentic environmentsChapters:00:00–03:58 — The Next 24 Months: What Comes Next?03:58–08:24 — How Agentic AI Changes the Security Landscape08:24–11:26 — New Attack Paths & Unpredictable Agent Behaviour11:26–14:26 — Which Identity Controls Break First?14:26–17:26 — Ephemeral Agents, Lifecycle & Delegation17:26–20:24 — The Key Controls for an Agentic World20:24–23:22 — Governance, Shared Signals & Visibility23:22–25:58 — The Road Ahead for NHI & Agentic AI SecurityThe NHI & AI Identity Summit at IDV 2026 brings together identity, IAM, cybersecurity and AI security leaders to explore how Non-Human Identities and agentic AI are reshaping enterprise security.Subscribe for more sessions from the NHI & AI Identity Summit at IDV 2026.#NHI #NonHumanIdentity #AgenticAI #AIIdentity #IdentitySecurity #IAM #Cybersecurity #IDV2026

The NHI and agentic AI security market is growing quickly — but for security leaders, the question is no longer simply what products exist. It is how to evaluate them, implement them and prove their value.In this session from the NHI & AI Identity Summit at Identiverse 2026 (IDV 2026), security leaders discuss the buyer’s perspective on evaluating NHI and agentic AI security solutions across discovery, enforcement, monitoring, governance, implementation and business value.The conversation explores how organizations can cut through market fragmentation, define their requirements, evaluate vendors and avoid buying technology that is difficult to implement or fails to address the problems that matter most.Speakers:Amit Masand — Founder & CEO, IDM ExpressMurad Dikeidek — Head of Cybersecurity, UI HealthSteven Rennick — Senior IT Architect, CienaWhat You’ll Learn:• What security buyers should evaluate before choosing an NHI or agentic AI security solution• Why discovery, enforcement and monitoring all matter• How to evaluate products against real business and security requirements• Why implementation and adoption can matter as much as product capabilities• How governance, accountability and cross-functional ownership affect buying decisions• What buyers should look for in emerging AI identity security platformsChapters:00:00–02:57 — The Buyer’s Dilemma02:57–06:01 — How Security Buyers Evaluate the Market06:01–09:57 — Measuring Product Value & Business Outcomes09:57–12:51 — Discovery, Enforcement & Monitoring12:51–15:57 — Governance, Committees & Implementation15:57–18:57 — Evaluating AI Identity Security Capabilities18:57–20:02 — Buying NHI & Agentic AI Security in the EnterpriseThe NHI & AI Identity Summit at IDV 2026 brings together identity, IAM, cybersecurity and AI security leaders to explore how Non-Human Identities and agentic AI are reshaping enterprise security.Subscribe for more sessions from the NHI & AI Identity Summit at IDV 2026.#NHI #NonHumanIdentity #AgenticAI #AIIdentity #IdentitySecurity #IAM #Cybersecurity #IDV2026

AI agents need identity, access and authorization — but the standards and frameworks used to govern them are still evolving.In this session from the NHI & AI Identity Summit at Identiverse 2026 (IDV 2026), identity and security experts examine the standards, protocols and frameworks emerging around agentic AI, including agent identity, OAuth, MCP, delegation, authorization, context and auditability.The discussion focuses on a practical challenge for enterprises: how to combine existing identity standards with emerging agentic protocols to control what AI agents are allowed to do and maintain visibility over their actions.Speakers:Dr Rogério Rondini — Senior Manager, PwCRahul Godha — Software Engineer, LinkedInNiv Goldenberg — Co-Founder & CPO, Linx SecurityDavid Goldschlag — Co-Founder & CEO, AembitWhat You’ll Learn:• How identity standards are evolving for AI agents• How to model agent identity, access and authorization• The role of OAuth, MCP, delegation tokens and transaction context• How multi-hop delegation changes authorization and auditability• Why centralized agent registration and discovery matter• How to scope, monitor and audit what agents and sub-agents are allowed to doChapters:00:00–03:58 — Governing AI: The Identity Standards Challenge03:58–08:58 — Modeling Agent Identity, Access & Authorization08:58–12:56 — MCP, OAuth & Emerging Agent Standards12:56–17:20 — Tool Calls, Policy Enforcement & Authorization17:20–21:04 — Agent Architecture, Gateways & Data Handling21:04–25:31 — Agent Registries, Context & Delegation25:31–30:42 — Multi-Hop Delegation & Permission Scoping30:42–35:24 — Transaction Integrity, Intent & Traceability35:24–41:22 — What Standards Can and Cannot SolveThe NHI & AI Identity Summit at IDV 2026 brings together identity, IAM, cybersecurity and AI security leaders to explore how Non-Human Identities and agentic AI are reshaping enterprise security.Subscribe for more sessions from the NHI & AI Identity Summit at IDV 2026.#NHI #NonHumanIdentity #AgenticAI #AIIdentity #IdentitySecurity #IAM #Cybersecurity #IDV2026