AI agents are moving across systems, making decisions and, in some cases, creating other agents. But enterprises still do not have consistent standards for identifying them, governing their permissions or tracing what they do.

In this episode of ClearTech Loop, Jo Peterson talks with Rob Tiffany, Research Director at IDC, about why traditional identity and access management may not be enough for the agentic AI era.

Rob argues that the identity problem becomes much bigger once agents begin operating beyond a single enterprise. Companies need to know who an agent belongs to, what it is allowed to do and whether its activity can be audited and traced. As Rob puts it, there are still no consistent standards around agent “identity and permissions and auditability and traceability.”

He also discusses an idea he is exploring with Cerf: whether AI agents may eventually need something similar to a global registry, analogous to DNS, so their identity, permissions and traceability can be verified across networks and organizations.

The conversation also gets into shadow AI, employee adoption and why the most productive people inside an organization may be among the first to use AI tools before governance catches up.

In This Episode

• Why traditional IAM was not built for autonomous AI agents
• How software agents have existed for decades, from scripts to RPA
• Why identity becomes harder when agents create other agents
• The need for permissions, auditability and traceability across organizations
• Why AI agents may eventually need a global identity layer
• How shadow AI is entering enterprises faster than governance can respond
• What CISOs should be thinking about when AI adoption is already ahead of controls
• Why productivity cannot come at the expense of enterprise security

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

AI agents are already operating inside enterprises, accessing systems, making decisions and, in some cases, creating other agents.

The problem? Many organizations still cannot answer some very basic questions: What agents are running? Who owns them? What can they access? And who is accountable for what they do?

In this episode of ClearTech Loop, Jo Peterson talks with Michael Krigsman, founder and host of CXOTalk, about what AI security looks like when the workforce is no longer entirely human.

Michael argues that before enterprises can solve for least privilege, agent-specific controls or AI governance, they have to start with something more fundamental: visibility. Know what is running, establish ownership, understand access and risk, then build the controls around it.

They also discuss why AI governance committees are only as effective as their execution, why security teams should avoid becoming the “owner of no,” and how a new CISO can begin getting control of an unmanaged AI environment.

In this episode:

• Why traditional IAM and PAM were not built for autonomous AI agents
• Why agent inventory and visibility have to come first
• What happens when agents create subagents with their own permissions
• The gap between AI governance policy and actual enforcement
• How leaders should think about shadow AI
• Where a new CISO should begin in the first 30 days
• Why AI agents may need to be managed more like employees, contractors or freelancers

Michael leaves leaders with a practical way to think about the problem: give agents identities, know what jobs they are doing, know who owns them and know what they can access.

About Michael Krigsman

Michael Krigsman is a globally recognized analyst, strategic advisor and industry commentator focused on digital transformation, innovation and AI leadership. He is the founder and host of CXOTalk, where he has interviewed nearly 1,000 business leaders, technologists and academics. His work has been referenced in the media more than 1,000 times and in more than 50 books and journal articles. Pasted markdown

Worth Reading + Watching

Hugging Face: Anatomy of a Frontier Lab Agent Intrusion
A technical look at the incident discussed during the episode and how autonomous agent activity can move across systems and trust boundaries.

Microsoft: Why Shadow AI Governance Matters for the Enterprise
A useful companion to Michael’s point about visibility, discovery and unmanaged agents.

ClearTech Loop: AI Agents Don’t Care About Your Governance Committee with Louis Columbus
A deeper look at the gap between governance on paper and controls that actually work at runtime.

ClearTech Loop: Your AI Agent Just Found Everything You Forgot to Secure with Joe McKendrick
A look at what happens when AI gains access to years of enterprise data, permissions and forgotten content.

Stay in the Loop

Subscribe to ClearTech Loop for conversations with technology leaders about AI, cybersecurity, cloud and the issues changing enterprise technology right now.

And one question to take back to your team:

Could your organization produce a complete inventory of every AI agent operating today?

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/

AI agents are gaining credentials, permissions and the ability to act across enterprise systems. But what happens when they discover years of forgotten files, excessive permissions and data that was never secured with AI access in mind?

In this episode of ClearTech Loop, Jo Peterson talks with longtime technology analyst and Forbes contributor Joe McKendrick about the security implications of the agentic workforce.

They discuss:

• Why AI agents should be treated like non-human identities
• The gap between AI governance policies and actual enforcement
• How agents can expose forgotten enterprise data and permissions
• Why human oversight and accountability still matter
• What security leaders should be thinking about as agentic AI expands

Joe offers a simple warning: treat your AI agents with the same caution and restricted access you would give an intern.

Because AI may not create your security debt.

It may simply be the thing that finally exposes it.

🎧 Listen: In Buzzsprout Player
▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos
📰 Subscribe to the Newsletter:
https://www.linkedin.com/newsletters/7346174860760416256/