#436 - Sponsor Spotlight - P0 Security

This episode features Greg Danny, CTO of PZ Security, explaining how runtime access control and dynamic roles are essential for securing unpredictable AI agents and non-human identities (NHIs) while moving toward zero-standing-privilege architectures.

Key Takeaways:
• Runtime access control enforces authentication and authorization at the exact moment of execution, addressing the dynamic nature of AI agents that static permissions cannot secure 7:22.
• Agentic identity requires distinct tracking and audit trails to prevent risks associated with agents inheriting or impersonating human access 12:51.
• PZ Security uses "dynamic roles" that inject variables like customer IDs into policy templates, enabling granular real-time filtering without pre-defining thousands of static roles 23:45.
• Agent intent is determined by comparing actions against independent sources of truth, such as ticketing metadata, to provide automated evidence for authorization 19:26.
• A critical overlooked risk is "context drift" or human prompting errors, where agents may misinterpret vague instructions and perform destructive actions 30:35.
• Organizations should start with low-risk, friendly use cases to establish best practices rather than waiting for perfect standards 39:48.

Implementing runtime access control and dynamic roles allows organizations to secure agentic identities effectively without relying on brittle static permissions.

Sources:

• 07:22 Definition of runtime access control for agents
• 12:51 The need for distinct agentic identity tracking