by Gary Zimmerman | Nov 1, 2026 | AI, Governance, Identity
For the last three weeks we’ve been talking about agents that are busy. We covered how to prove who authorized what an agent did, how to keep its authority narrow as work gets handed from one agent to the next, and last week, how to stop one that goes off-script...
by Gary Zimmerman | Oct 26, 2026 | AI, Governance, Identity
Two weeks ago we talked about proving who authorized an agent’s action – If Your Logs Can’t Tell a Person From an Agent, You Don’t Have Proof. Last week was about keeping that authority narrow as work moves from one agent to the next –...
by Gary Zimmerman | Oct 19, 2026 | AI, Cybersecurity, Governance, Identity
Last week I asked a simple question: for the last thing an agent did, how long would it take you to name who authorized it – If Your Logs Can’t Tell a Person From an Agent, You Don’t Have Proof? This week I want to make that question harder. Because...
by Gary Zimmerman | Oct 12, 2026 | AI, Cybersecurity, Governance, Identity
Last week I asked where your AI policy actually fires LINK: Your AI Policy Isn’t a Control Until It Fires. This week I want to ask what happens after it fires. Can you prove it did? Here’s the scenario I keep coming back to. An agent in your environment...
by Gary Zimmerman | Oct 5, 2026 | AI, Governance, Identity
Last week I asked which way your guardrails fail when they stop working Which Way Does Your Guardrail Fail?. This week I want to back up a step and ask something more basic. Is your AI policy connected to anything at all? That sounds like a rhetorical question. It...
by Gary Zimmerman | Sep 28, 2026 | AI, Cybersecurity, Identity
Last week I argued that a short-lived, tightly scoped credential is the one gate that doesn’t depend on the agent’s cooperation [LINK: Your Credential Policy Was Written for Humans]. That argument has an assumption buried in it. It assumes the gate holds....
by Gary Zimmerman | Sep 21, 2026 | AI, Cybersecurity, Identity
Last week’s FuBAC analysis listed credentials as the sixth attribute of the Artificial Identity: short-lived, task-scoped, cryptographically verifiable, issued per function and expired at completion. It is the attribute that sounds most like routine hygiene and...
by Gary Zimmerman | Sep 14, 2026 | AI, Governance, Identity
The governance architecture that Black Hat 2026 defined — the five-layer control plane for AI agents built from identity outward — depends on a premise that most enterprise identity programs have not yet confronted: role-based access control does not work for AI...
by Gary Zimmerman | Sep 8, 2026 | AI, Identity
There is a version of the AI governance conversation that has been happening for two years in conference rooms and board briefings and risk committee agendas. It is a conversation about frameworks and policies and responsible AI principles and vendor attestations and...
by Gary Zimmerman | Aug 4, 2026 | AI, Governance, Identity
On July 28, Cyera announced it was acquiring Oasis Security for $1 billion. The same day, Hush Security announced a $30 million Series A. Two days later, Okta announced it was acquiring Permiso Security — financial terms undisclosed, but strategically significant...
Recent Comments