Almost everyone’s workplace experience is now set to welcome AI-agent-driven actions through the applications we use daily, and this rapid evolution has some serious implications for how identity and access management (IAM) works. 

While traditional IAM models were developed with human users and their predictable access patterns in mind, AI agents operate differently.

AI agents can quickly perform reasoning functions that impact the way business analytics feeds into board-level management dashboards; they can invoke tools that fuse new connections to an API, update a database, or run a new software script; and they can access other software services and data resources across an organization’s infrastructure and total software stack in dynamic, continuous, and sometimes unpredictable ways.

Cloud infrastructure automation and security company HashiCorp has sought to provide IAM services capable of servicing the agentic age for some time. 

Before it became an IBM company in February last year, HashiCorp introduced Boundary in 2020 as an open-source project to allow software engineers to securely access dynamic hosts and services with fine-grained authorization without direct network access.

IBM senior solutions engineer Andre Faria and HashiCorp senior technical product marketing manager Van Phan blogged on June 4 to explain that as agents now go into live production systems, they will have access to “critical infrastructure resources” such as internal web services, cloud platforms, and other operational systems. 

The pair say this is concerning if agents are improperly provided with long-lived static credentials that are poorly managed, rarely rotated, and tough to audit.

Credentials that are poorly managed: “a dangerous combination.”

“This creates a dangerous combination of broad access and limited oversight. Without proper guardrails, AI agents may autonomously make decisions or execute actions that negatively impact production workloads, corrupt data, trigger outages, or unintentionally expose sensitive information,” write Faria and Phan.

They further note that organizations need a way to monitor which sessions are active, which systems AI agents access, when they access them, what actions they perform, and whether their behavior deviates from policy. 

Because agentic runtimes and individual execution behavior are so inherently fluid and prone to change, we can no longer set identity management, authorization, and session control policies at the point of deployment — every agent needs a unique identity and just-in-time privileges that act as a secure point-of-use access layer.

It’s time for just-in-time

Because agentic runtimes and individual execution behavior are inherently fluid and prone to change, we can no longer set identity management, authorization, and session control policies at deployment. Every agent needs a unique identity and just-in-time (JIT) privileges (a zero-trust-based secrets management technique that acts as a secure point-of-use access layer) to ensure software systems don’t become brittle or susceptible to attack as they scale.

“With Boundary’s authorization flow, access to a specific resource is granted only when needed, for a specific action, and only for the duration of that session. This helps organizations strengthen governance and maintain tighter control over how AI agents access critical infrastructure,” wrote Faria and Phan.

Boundary applies similar principles to ensure non-human and agentic identities do not have overprivileged access or handle static long-lived credentials. The software also provides monitoring, audit logs, and session recordings that can be used to play back and reveal detailed actions taken by AI agents during session access.

Adopting dynamic credential brokering 

Underlining his original blog, IBM’s Faria tells The New Stack that the IBM 2025 Cost of a Data Breach Report states that the global average breach costs organizations $4.4 million. He says it also shows that 97% of organizations that reported an AI-related security incident lacked dedicated AI access controls, and 63% did not have any AI governance policies to manage AI or prevent shadow AI.

“The risk highlighted by those statistics, plus the fact that agent compromise is now the fastest-growing attack vector in the industry, showcases why it is urgent to define a solid and secure infrastructure access strategy for agentic AI workflows,” says Faria, who also points to the role HashiCorp Vault plays regarding dynamic credential brokering for Boundary. 

Boundary can facilitate the use of dynamic credentials rather than static credentials. When paired with HashiCorp Vault, access with dynamic credentials becomes a reality because Vault’s secrets engines generate short-lived credentials that expire after use. Even if a credential is intercepted, it cannot be used to cause damage. 

But is all of this enough?

“Agents are non-deterministic and operate at machine speed. To contain them, they need hardened, isolated runtimes that govern their behavior before they ever touch production. Cryptographic identity, just-in-time, short-lived privileges, plus ephemeral, trusted runtimes for agents to operate in – that’s the bar.” – Ev Kontsevoy, Teleport.

An immutable cryptographic hardware root of trust

Ev Kontsevoy, CEO and co-founder of AI infrastructure identity specialist Teleport tells The New Stack that just-in-time privileges and auditable control for AI agents aren’t new ideas per se. He advises that every agent today needs its own identity, cryptographically secured by a “hardware root of trust,” i.e., immutable cryptographic keys that reside at the chip level.

“To enforce policy consistently across infrastructure, software engineering teams need a unified identity layer — one that treats humans, machines, workloads, and AI agents the same way, as first-class identities,” Kontsevoy says. “Agents are non-deterministic and operate at machine speed. To contain them, they need hardened, isolated runtimes that govern their behavior before they ever touch production.”

Looking at the live working accounts it touches, the Teleport team reports that credential sprawl in service accounts and tooling remains one of the biggest attack surfaces in production infrastructure today. 

“It’s not enough to manage credentials better; we need to eliminate them entirely so they can’t result in standing privileges or unintended actions. Cryptographic identity, just-in-time, short-lived privileges, plus ephemeral, trusted runtimes for agents to operate in – that’s the bar,” Kontsevoy insists.

“Developer and agent identities often sit on attack paths to critical systems because they can provision infrastructure, retrieve secrets, trigger pipelines, query data stores or inherit trust from other services.” – Justin Kohler, SpecterOps.

Defining attack paths to critical systems

As we seek to tame the Wild West of agentic access and actions through identity services, we may be overlooking that identity itself can act across cloud, developer, and production environments. 

Justin Kohler, chief product officer at identity attack path management (IAPM) company SpecterOps, tells The New Stack that developer and agent identities often “sit on attack paths to critical systems”, meaning they can provision infrastructure, retrieve secrets, trigger pipelines, query data stores, or inherit trust from other services. 

“Organizations need to understand where these identities can actually take them, continuously prioritize the paths that create the most risk and then enforce and audit access at the point it is used,” Kohler says. “If those identities are over-permissioned, impersonated or manipulated, the compromise follows the same relationships an attacker would, from one identity, to one system, to the next trust boundary.”

Integrated authentication & authorization in automated applications

If now seems like the right time to talk about this, the Cloud Native Computing Foundation (CNCF) TAG Security and Compliance committee posted a blog to showcase a new whitepaper last Thursday. The whitepaper supports the foundational security philosophy outlined in the HashiCorp blog above, but underscores the need to embrace open-source, vendor-neutral standards rather than proprietary software.

According to the whitepaper, “Controlling access to systems and data is a fundamental requirement in any environment; in cloud-native environments, this requirement is shaped by characteristics such as highly dynamic and short-lived workloads, the collapse of perimeter-based trust models, and the need to integrate authentication and authorization into automated application lifecycles.”

The takeaway here seems pretty clear: Short-lived workloads and long-lived credentials don’t mix, but just-in-time, short-lived privileges — a period that used to be 90 days, but shrunk to 24 hours, then to minutes, and now down to a period we can call the “ephemeral lifespan” — is now the clock we need to run to.

The post “A dangerous combination”: The 2 factors that can “corrupt” AI agent workflows appeared first on The New Stack.

Kore wants to drag enterprise agent development out of the prompt-chain wilderness. The agentic software company on Thursday released Artemis, the latest edition of its Kore Agent Platform. It’s a visual and code-based environment for building, governing, and optimizing multi-agent AI systems, built around a declarative blueprint language, a dual-brain runtime, and a machine architect that writes agents from plain-language objectives.

Somewhat quirkily defined as multi-engine NLP, Artemis is a multi-pronged NLP engine that employs so-called fundamental meaning (where sentences are broken down into grammar, synonyms, and concepts), machine learning, and knowledge graph technologies to form a service greater than the sum of its parts.

Described as no-code/pro-code (rather than no-code/low-code), Kore uses the term to denote its platform’s ability to allow developers to use both traditional programming languages, plus a crucial gateway connection to integrating APIs into the final multi-agent AI system.

What makes Kore AI-native?

In an era when every software vendor is compelled to claim a level of inherent AI capability (and Kore can’t quite help itself, succumbing to using its .ai company name extension), the company claims to validate its position in this space with its trademarked Agent Blueprint Language (ABL).

Kore has explained ABL as a compiled, declarative language that standardizes how AI agents, systems and workflows are defined, validated and governed. Six built-in orchestration patterns (supervisor, delegation, handoff, fan-out, escalation, and agent-to-agent federation) are in place to allow developers to build production-grade multi-agent systems.

Head of Products and Chief Technology Officer at Kore Prasanna Arikala tells The New Stack that ABL has been built for portability and governance from the get-go.

“Prompt-chain frameworks like LangChain, LlamaIndex, Semantic Kernel, and the hand-rolled orchestrator scripts most teams end up with are imperative: developers wire chains in code and discover schema drift, missing tool references, or broken handoffs only when an LLM call fails in production – ABL inverts that model,” Arikala says.

He explains that developers (or designers, via the visual editor) author a declarative blueprint consisting of agents, tools, memory, guardrails, supervisors, and topology in a typed DSL.

“Our parser and compiler statically validate the entire agent graph, surfacing contract mismatches, unresolved tools, unbound memory slots, and unreachable states before a single token is generated. The payoff is portability and governance,” he says.

More Kore trademarks are on offer with Arch, the organization’s agent architect. Not a person (although engineered to act like a human systems architect), this machine entity works to translate business objectives into production-ready ABL.

It supports the full agent lifecycle (i.e. design, build, train, extend, monitor and sometimes retire) and lays down the underlying agent topology, which means it is capable of continuously refining agent behavior using real-world production traces.

The agent with two brains

Alongside the ABL language and the Arch agent architect (Archie would have been more entertaining, but we get it) Kore offers a third component in its triumvirate of AI-native tools. The company’s dual-brain architecture is a pair of two cognitive engines (combining both agentic reasoning and deterministic flows) that operate in parallel. The dual-brains work through shared memory, are authored in a unified language and governed by a single runtime.

CTO Arikala further explains what’s happening here and says that the dual-brain architecture pairs two execution engines on a shared, typed memory layer: a reasoning brain of LLM-driven agents that plan and improvise, and a deterministic brain of scripted flow agents that enforce business rules, transactions, SLAs, and compliance steps.

“The two brains never write into each other’s state unmediated,” clarifies Arikala. “Every memory slot in an ABL blueprint declares an owner, a visibility, and a write policy. Reasoning agents propose state changes; the deterministic engine commits them through the transactional store; the supervisor arbitrates conflicts using priority rules baked into the blueprint – this means deterministic logic wins on hard constraints, reasoning wins on advisory slots, and ties resolve to a human-in-the-loop step where the blueprint asks for one.”

By way of elevation, the Kore platform operates independently of the AI model in use. This separation of church and state is undertaken to keep AI systems predictable, auditable and scalable from their experimental prototyping stage all the way through to production-grade operations.

“The architectural rigor stands out,” said Parikh. “Compiled blueprints, governance in a separate deterministic layer, and one language for every agent are the design choices enterprise AI has been missing.” – Keyur Parikh, Vanguard.

Architectural rigor for agents

Keyur Parikh is head of workplace technology strategies and services at Pennsylvania-based financial services company Vanguard. As a Kore customer, Parikh has had early visibility into the Korei Agent Platform.

“The architectural rigor stands out,” said Parikh. “Compiled blueprints, governance in a separate deterministic layer, and one language for every agent are the design choices enterprise AI has been missing. Previously, in prompt-chaining frameworks, multi-agent orchestration is something you build. In ABL, it’s something you declare.”

CEO and founder of Kore, Raj Koneru, has said that he thinks enterprise AI is entering its third wave, where governance, observability, and trust define success.

“The Kore Agent Platform reflects this shift by bringing an AI-native architecture to market that enables enterprises to build, manage, and optimise multi-agent systems with confidence,” said Koneru. “This level of depth comes from a decade of delivering AI experiences in complex, regulated environments, where scale, compliance, and reliability are non-negotiable.”

This is AI, building, governing and optimizing AI

Koneru and team position this technology as AI, building AI. This assertion stems from the way Arch generates production-ready agents from plain-language objectives, writes them in ABL, and validates them before deployment. 

It’s also AI governing AI i.e. every decision, path, and outcome is logged, traced, and analyzed by AI in real-time. Deterministic constraints and flow controls are enforced by the platform itself, not left to the agent.

Thirdly, it is said to be AI optimizing AI. The platform learns from production signals and recommends specific improvements as reviewable optimizations, with human oversight built in.

What the CIO, CISO and CFO should think

For the third time using the power of three, Kore has a message for the CIO, CISO and CFO in relation to its release of Artemis. 

For the CIO, it’s a manageability message – the platform consolidates fragmented third-party and home-grown agents into one foundation. For the CISO, AI behavior becomes predictable – governance is enforced at the platform layer, outside the model’s control. 

Every agent action and policy decision is logged, timestamped, and traceable to a specific regulatory control.

Thirdly, for the third time, for the CFO, the company has suggested that AI investments are compounded – Arch, ABL and the runtime are shared infrastructure across every agent, so the marginal cost of the Nth agent approaches the cost of authoring its blueprint. 

Microsoft Azure compatibility 

The Artemis edition of the Kore platform launches initially on Microsoft Azure, with a promise of “broader cloud availability” to follow. For enterprises standardized on the Microsoft stack, the Kore platform integrates with Microsoft Foundry, Microsoft Agent 365, Entra ID, and the Microsoft Graph API. It also powers a native Microsoft Teams channel through the Azure Bot Framework.

Customers deploy in public cloud, sovereign regions, private cloud, or on-premises, with data residency by region. 

The post Kore counts down to Artemis, its moonshot for governable AI agents appeared first on The New Stack.