What was the main authorization takeaway from Identity Week America 2026?

The main authorization takeaway from Identity Week America 2026 was that federal agencies, defense contractors and B2B SaaS companies all arrive at the same question for AI agents. Who or what is asking, what is it trying to do, to which resource, and in what context. That question was solved or half solved for human users, is part way through for workloads, and AI agents now ask it a third time at a pace a quarterly access review cannot keep up with. The answer at the booth and on the panels was a policy enforcement point in front of the action, a policy decision point behind it, and a log of every decision.

How should AI agent authorization decisions be made at runtime?

AI agent authorization decisions should be made at runtime, per action, by something deterministic, with a log that explains why. Andrew Ashcroft of M&T Bank put it as having to move to policy based access control and having to be in the runtime. The architecture the Identity Week America panel described bounds what the agent can see, sandboxes where it runs, and puts a policy enforcement point between the agent and the action, so the decision is made outside the model rather than inside the prompt.

Who should own an AI agent when the person who created it leaves?

Ownership of an AI agent when its creator leaves depends on what kind of agent it is. Assistive agents that help one person do their job can be killed when that person leaves, since the agents go with them. Workload agents that run part of the business need an ownership construct, so there is a named owner accountable when something goes wrong. Both cases need the agent's access to be tracked from the start, or the leaver problem that exists today with shared and service accounts will repeat with agents.

How do you tier AI agent actions by risk?

You tier AI agent actions by risk by deciding, per action, what level of control the outcome needs. On the Identity Week America panel, Hemang Upadhyay of LG Electronics gave a retail example. Comparing products is low risk and can run unattended. Placing a supplier order is medium risk, so it gets a human in the loop and a spend threshold. Issuing a refund is high risk, so it needs approval with no exceptions. A "not yet, go get approval" outcome is an authorization decision in its own right, not a failure of the allow or deny model.

Identity Week America 2026: Same AI Agent Authorization Problem, Different Badges

I spent 2 days in Washington DC last week at Identity Week America. Emre and I had booth 720 and about half the swag we planned, because British Airways kept my suitcase in London. It didn't slow the conversations down though!

Identity Week America 2026 - Same AI agent authorization problem, different badges. Cerbos..png

Federal agencies, defense contractors and SaaS teams brought the same authorization question

DC gives this show a different crowd from other shows like Identiverse. Federal agencies, defense contractors, and the banks and SaaS companies that sell to them. What struck me was how little the conversation changed as the badges did. A government team, a defense contractor and a B2B software company would each walk up with a different system and the same problem. Who or what is asking, what is it trying to do, to which resource, in what context. Solved (or half solved) for humans, part way through for workloads, and now agents ask it a third time, faster and with less patience for a quarterly review.

So we drew the same sketch over and over. An enforcement point in front of the action, a policy decision point behind it, a log of every decision, and no interest in whether the principal is a person, a service account or a model. Same conclusion I brought back from Identiverse in June, with a more federal accent.

Identity Week America 2026 - AI authorization diagram sketch.png

License to Thrill, the Identity Week America panel on AI agent governance

The panel that captured it best was "License to Thrill," on whether we can control and authorize what AI agents do in the field. George Fletcher (OpenID Foundation) moderated Andrew Ashcroft (M&T Bank), Anna Pasupathy (KeyBank), Ken Huang, Hemang Upadhyay (LG Electronics) and Donovan Blaylock (Cerby). Practitioners from regulated industries, saying from the stage what we'd been hearing at the booth.

AI agent ownership and blast radius, the leaver problem repeats for non-human identities

Donovan's team only gets called in after something has gone wrong. "We only see the unsuccessful side of the house." His word for it was blast radius. "Even if someone owns the agent, the access it has could be somebody else's." The leaver story is the one every sector recognizes. Someone resigns, and a year later you find their shared account still being used by something, because it was never tracked. Swap "shared account" for "service account" and it's the workload problem from 5 years ago. If people did the basics, "we would never get called. But we do get called."

Andy from M&T Bank was blunt about the fix. "We have to go to policy based access control. We have to be in the runtime." Assistive agents you can kill when their owner leaves ("cool, kill them, those agents go with me"). Workload agents run the business, so you need an ownership construct and, in his words, "a throat to choke when something goes wrong."

A policy enforcement point between the agent and the action, tiered by risk

Anna and Ken sketched the architecture Emre and I had been drawing all week. Bound what the agent can see, sandbox where it runs, put a policy enforcement point between the agent and the action, decide deterministically behind it. Hemang tiered it by risk. Product comparison is low. Placing a supplier order is medium, so a human in the loop and a spend threshold. Refunds are high, so approval, no exceptions. That "not yet, go get approval" outcome is a decision in its own right, and it's the shape we've been building towards. Which, yes, is the thing we sell, but the panel got there without any prompting from me.

Audit trails are still unsolved for AI agents

Audit is still unsolved, and the panel said so. Donovan's story from his own booth that morning was an ad agency whose bots posted unapproved creative to 7 platforms, with a factual error, under a contract that said nothing about AI. Working out who was accountable is "really, really hairy." And Andy's warning stands. If you haven't solved the audit log problem, you can't trust an agent to audit the agent.

What I'm taking back from Identity Week America 2026

So that's Identity Week. Governments, defense contractors and businesses at the same whiteboard, with humans, workloads and agents on it. Agents get in through identity. What they can touch is an authorization question, answered at runtime, per action, by something deterministic, with a log that says why. Ownership and audit are still open, us included, and I'd rather hear a panel admit that than pretend otherwise.

Try Cerbos to see what a runtime decision on an agent's action looks like, with the reason it was allowed or denied recorded, or book a call and we'll go through how it sits downstream of your IdP.