Identity and Access Management

IAM is the foundational control system for policies and technologies that ensures the right identities have the right access to the right resources at the right time. It covers how identities are created, how they authenticate, what they’re authorized to do, and how that access is managed and removed over time, across people and AI agents alike.

An identity provider verifies who a user is and issues the tokens or assertions that let them sign in to connected applications, typically through single sign-on (SSO). Centralizing authentication in an IdP gives organizations one place to enforce policies like MFA, conditional access, and session controls across their application estate.

Least privilege means granting each identity only the access it needs to do its job, and nothing more. It limits the damage a compromised account can cause. As AI agents gain their own access and privilege rights, least privilege becomes even more critical, since every over-permissioned agent expands the blast radius within an organization.

AI agents need the same IAM foundations as people: a distinct identity, strong authentication, scoped authorization, and a clear owner. Treating agents as first-class identities, rather than letting them borrow human credentials or shared service accounts, makes their access controllable, auditable, and revocable.

In the traditional model, an identity provider holds one complete key that signs every user’s access. If that key is stolen or the vendor is breached, attackers can forge valid logins for any user to any application, with no password or MFA required. Credential compromise is the leading cause of enterprise breaches. Secure Split Key (SSK) removes this single point of compromise by splitting the signing key between the identity provider and your organization, so neither half can complete a login on its own. Learn more about Secure Split Key.