What happened
Cisco’s identity division, represented by VP of product Matt Caulfield, has outlined a new security framework for managing AI agents in enterprise environments. The report argues that existing Identity and Access Management (IAM) systems, designed for human users, are inadequate for the rapid, non-human scale of deployment. Cisco proposes moving beyond static access control toward 'action control,' which requires continuous verification and cryptographic identity binding at runtime.
Cisco’s identity team asserts that the current enterprise approach to AI security is failing because it treats agents as extensions of human users rather than distinct entities. Because agents are deployed in minutes rather than the weeks or months required for human onboarding, they lack the background checks and identity verification processes standard for employees.
The proposed framework requires four core capabilities: discovery of active agents, hardware-bound cryptographic credentials, authorization at the level of individual actions, and continuous audit logging. This moves security away from 'least privilege'—which might grant an agent access to an entire GitHub repository—toward 'action control,' where an agent is authorized only to perform a specific task, such as merging a single pull request, for a limited window of time.
Cisco is integrating these concepts into its Duo platform, which now treats agents as first-class identities. Through the acquisition of Astrix, Cisco aims to provide visibility into non-human identities, including the secrets and permissions they utilize. The platform supports OAuth and authorization specifications used by the Model Context Protocol (MCP) to manage these scoped permissions.
Source details: venturebeat.com ↗
Why it matters
As enterprises deploy AI agents that operate at machine speed, traditional security models—which grant broad, role-based permissions—create significant risks of unauthorized data access or system manipulation. By shifting to action-level authorization, organizations can restrict agents to specific, time-bound tasks rather than granting them the full permissions of the human users they emulate. This approach addresses the 'identity gap' where agents currently bypass security by inheriting human credentials, providing a necessary layer of governance for autonomous software.
The primary risk identified is that agents currently act as 'proxies' for humans. If a human uses a password-based authentication method, they may inadvertently or intentionally pass those credentials to an agent, making the agent indistinguishable from the human in the eyes of the system.
Traditional Zero Trust architectures, while effective for users and devices, often fail to account for the specific, high-frequency actions of AI agents. By implementing action control, organizations can prevent an agent from performing unauthorized operations, such as force-pushing to production branches, even if the agent has legitimate access to the broader application environment.
This shift represents a fundamental change in enterprise security strategy, requiring organizations to re-evaluate network, endpoint, and data security through the specific lens of agentic behavior rather than relying on legacy IAM assumptions.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').What most distinguishes an AI agent from a basic chatbot?
What to watch next
Security leaders are increasingly prioritizing the discovery of 'shadow' agents already operating within their networks. Future developments will likely focus on how effectively platforms like Cisco’s Duo and its integrated Astrix technology can map non-human identities and enforce granular, just-in-time permissions across diverse cloud and on-premises environments. The industry's ability to standardize these agent-specific identity protocols remains a critical, unresolved challenge.
The effectiveness of discovery tools in identifying 'rogue' or unmanaged agents remains a key metric for security teams. Without a complete inventory of agents, governance policies cannot be enforced.
The industry is moving toward standardizing how agents authenticate. Watch for further adoption of phishing-resistant authentication and hardware-bound credentials as the baseline for non-human identity.
The integration of agent-specific security into broader enterprise stacks will be a major trend. Cisco’s focus on the Model Context Protocol (MCP) suggests that interoperability between agent frameworks and security platforms will be a critical area for development in the coming months.