Deepika Chauhan, Chief Product Officer, DigiCert
Â
“Every AI agent that can access data, use a tool, or take an action should have its own verifiable identity. Enterprises should establish which agent is acting, who is responsible for it, and what it has been authorized to do. Its permissions should be reviewed as its roles change, and its authority revoked when it is retired or no longer trusted.
Traditional IAM remains essential, but it cannot carry the whole burden. With autonomous agents, organisations need to verify what authority has been delegated and whether it is still valid. Cryptographically verifiable identity and narrowly defined permissions can extend existing access controls to those interactions; they do not replace the need to monitor what agents actually do. Certificates, service accounts, API credentials, and other machine identities can be created across teams, clouds, and applications, often without a complete inventory or consistent owner. Enterprises need to connect discovery with ownership, policy, and ongoing lifecycle management.
CIOs need to know where credentials are used, automate their renewal and replacement, protect the keys behind them, and revoke credentials or authority when necessary. They should inventory machine identities, certificates, cryptographic dependencies, and AI agents, and assign an owner to each. They should build cryptographic agility into procurement and architecture decisions so the organisation can adopt new standards as requirements change. The goal is to make trust something the enterprise can verify and manage continuously.”
