Identity at the Center

There are genuine substantive passages on agentic AI as a non-directed, non-deterministic identity problem, the case for decentralized identity frameworks in agent meshes, and the shift from LLMs to SLMs - but these are heavily diluted by a prolonged self-driving car tangent, humanoid robot speculation, dog cancer vaccine anecdote, and conference promotion that collectively consume roughly a third of the runtime.

“It's non deterministic because we don't know where it ends. It's also non deterministic because if we have the next version of the LLM, it may do it differently even if we try to do the same thing.”

“MCP server authorization is a little bit like what CA Sitemander brought to us in the year 2000. So we have a layer in front and we say, okay, we do some, in that case authorization, very coarse grain, and then we pass it by.”

The reframing of NHI taxonomy as 'autonomous identities vs dependent identities,' the argument that agentic AI constitutes a genuinely new problem rather than old problems at scale, and the recursive distrust framing (using AI to control AI) are reasonably fresh; however, most of the broader AI-identity narrative is circulating widely in the industry and the frameworks are high-level without delivering truly contrarian or first-principles conclusions.

“maybe we think more about autonomous identities like humans and agents versus dependent identities like workload identities or IoT identities, et cetera as a better abstraction”

“It's not just um, the old problem on steroids. It's a new problem.”

Kuppinger is a legitimate 35-year veteran who founded a respected analyst firm and demonstrably shaped industry frameworks like the identity fabric; he has real historical credibility and is not a career podcast guest, though he is an analyst-observer rather than an operator who has built and run these systems at scale inside an enterprise.

“of all the 35 plus years I'm in identity and security, it's probably the intellectually most fascinating challenge I've seen over all these years”

“When we did the first EIC and that was in a market where There were maybe 50 or 80 vendors back in 2007... right now we have truly way north of 1,000 vendors in this identity security space”

A handful of concrete anchors exist - the CA SiteMinder year-2000 analogy, vendor count growth from 50-80 to 1,000+, the 200-person pre-conference workshop, named actors like Max Schrems and Patrick Harding - but there are no enterprise case studies, dollar figures, breach data, or measurable security outcomes; most recommendations remain at a conceptual level without grounding in real deployments.

“MCP server authorization is a little bit like what CA Sitemander brought to us in the year 2000”

“we had some more than 200 people in the room... I had 10 fundamental changes back then. When we started, we had the workshop 15 already a few days later, plus we had a backlog of I think nine others”

The hosts land one genuine productive disagreement - pushing back on whether agentic AI is truly a new problem vs. old problems at scale - and the NHI verification/consent chain shows some topical ambition, but the episode is undermined by extended unchallenged tangents on self-driving cars, failure to probe for specific evidence behind framework claims, and a closing segment that wanders into health AI and humanoid robots with no substantive follow-up.

“So you think this is a new problem?”

“I would say in this case probably maybe the first time we have something where the problem is new. Because as I've said, this mesh of age and this non directed, non directed, non deterministic thing is really something which is, is different.”