Harish Peri (Okta): When the Thing Accessing Your Systems Has a Brain

Hi, I'm Kevin Werbeck, Professor of Legal Studies and Business Ethics at the Warden School of the University of Pennsylvania. For decades, I've studied emerging technologies from broadband to blockchain. Today, AI is promising to transform our world. But AI needs accountability, mechanisms to ensure it's developed and deployed in responsible, safe, and trustworthy ways.

On this podcast, I speak with the experts leading the charge for accountable AI. When the thing accessing your finance or HR system isn't a person, but an agent with a brain that can be manipulated or just hallucinate, identity becomes a different kind of challenge. Harish Peri runs AI security at Okta, the access management and identity company. And he's seeing enterprises race to deploy AI agents that they can't fully see or control.

In this episode, we talk shadow agents. kill switches, intent mismatches, standards, and more, as agentic security races to keep up with agentic deployment. Welcome Harish, thank you for joining me on the road to accountable AI. Fantastic.

Thanks for the opportunity. Okta's a a company most people know about for digital identity and things like single sign on. How did the company get engaged in governance of AI agents? People know us for SSO, which is which is accurate in that that's where we started 17 years ago.

But even before AI agents enter the picture, you know, our vision, bigger vision has always been getting the middle of people accessing technology. And as we we grew up in the age of the cloud where software moved to the cloud and became software as a service, and then identity and entitlements and access management really became a core pillar of security in general. So That's what that's what you know we've the journey, the bigger journey we've been on. And the new software is and will be agents, if you think about it.

Like that's the new way in which people are going to interact with tech. And then that tech will interact with whatever systems are the back end. you know, the the the traditional front end, as you know, it might go away and be replaced completely by agents. And so it's really is an extension of our responsibility to say, if we were protecting people accessing tech, we're now gonna protect people accessing agents or agents accessing agents and subagents and all all the permutations in between.

So it really is the natural next evolution of what we have always been up. At a broad level, what's different about thinking of that problem f in the agent context versus in the cloud context? I Yeah. The simple thing is um software doesn't have a brain.

Agents have a brain. And I I use I say that maybe with a little tongue in cheek. You know, software, even robotic process automation, if you think about it, is just it's it's deterministic. It's if then, it's procedural.

It does the thing that it's supposed to, give it an input, there's an output. With an agent, behind the scenes, it's really there is a large language model of some kind that is making a decision to say, should you know, a Based on what a user is telling me, should I actually allow or sorry, should what action should I take? There is a level of non-determinism that's involved in it. So the bar to make sure that an agent that has either been manipulated or has just hallucinated in general is not gonna the the bar for that to protect that agent from accessing the wrong resources or taking the wrong action is a lot higher.

And so the non-determinism, while it leads to a lot of efficiencies. Um also leads to a higher degree of risk. And then what gave you the idea that from a business standpoint, focusing on these issues of aid and security was was something where there was an opportunity there? You know, it's it's it this is a one of the few cases where the market came to us overwhelmingly.

Um it's it it at some point it would make for a good um case, actually, if in your world, where you know, pretty much maybe eight months ago, we started to see a massive influx of just questions from our our own customer base saying, Hey, we're starting to see the rise of agents in our workforce. We know that there is a security risk. Please help us. And so that was a perfect kind of conf convergence of our vision and what the market wanted to do as well.

So it it's it's a it's a good time to be in the agent space overall. But at a general level, there you know, there's lots of cybersecurity companies and other companies that that have deep experts on the cyber side. How do the skill sets that you have in that that access management and identity world play into this context? Yeah.

The agents are one of the f uh had the one unique characteristic that they they live on what's called the application layer, which means they're it's a kind of an app that could be running in the cloud, it could be running on your machine, it could be you know, built by a SaaS vendor that now has an agent. And you know, the brain I talked about being the large language model, that's one piece. The arms and legs, if you will, are the access hooks that the agent has into all the resources in your organization.

You know, you hear a lot about MCP. That's one type of access. There's yeah, there are there are other ways in which agents can access the resources, but it's ultimately an access. And more importantly, it's an authorization problem.

Is this agent allowed to execute this action or access this data at this moment in time on behalf of this user, given all available signals? So that very much lives in that application layer, more so than in the network layer or the endpoint. Piece or in broader cloud security. Now, the other components of the cyber stack are critical because they will, you know, they, they, when you put them all together, it it helps define a new type of zero trust where you can always trust but verify an agent's actions.

You need signals from the other parts of the cybersecurity stack, but they all have to converge on identity and authorization. What does it mean then to focus on the application layer? What practically does that change in terms of how you design a solution? Well what what what I think that nothing well, some a lot of things change and then at the same time nothing's changed.

Nothing changed a few few things change. What changes is if you're an organization know, creating your own agents, you do need to rethink through the the new types of security risks that can come into play. and it then it's it's there's a it's a combination of security security risks and also bad behavior. Security risks are things like prompt injection.

Where, you know, like as a company, if you're exposing an agent to a, you know, to a to a user, likely there's going to be a chat interface. That chat interface is is essentially like opening up a new attack vector into your organization. And so prompt injection becomes a new kind of attack um vector, if you will. But also really thinking through are agents going to operate within their guardrails?

Are they going to literally lose their minds or not? Is is also a very real consideration. So It changes the calculus of what security actually means if you're if you're building agents. Now, on the flip side, the things that don't change are still hygiene.

You still need to ensure that, you know, at the at the identity level, things like API keys and access tokens don't just get, you know, publicly exposed. They're you know, because even if someone is not trying to manipulate an agent, an agent will try multiple execution methods in order to get his job done. And one of those could be let me just scan the file system and see if I can find an API key that's written in plain text somewhere and then proceed to delete a database. These have happened.

These are real situations that have happened. And so data hygiene, access hy authorization hygiene, all are old issues. These have been around for 30 years. They become even more important now.

So some things change and some other things are the same, but even more relevant than before. Do you have a working definition about what constitutes an agent? Does it matter? People use these terms in in very uh unclear ways often.

Yeah, yeah. And I yes, that's that's a fair that's a fair point. I mean, agentic is a broader category of systems that can, you know, take actions or or make some decisions on their own that may not be a direct reflection of what they were prompted to do because they have some reasoning and some inference baked in there. but but the agents that I'm referring to are specifically um enterprise agents, these carry the biggest risk because you You know, if you have an agent that is accessing your finance system or your HR system or payments or ERP or your sensitive documents, and if it's an agent that multiple users are hitting at the same time, that creates a higher bar for security.

I I would argue that if it's something simple where you're just asking, you know, Copilot or Google to say, summarize my email or move this data into PowerPoint and make it look good, that the risk is minimal because it's 100% within your envelope. It's when it leaves your envelope and has autonomy and also delegation that transcends who you are. That's where that's the type of agent that requires the highest level of uh risk, risk management. You mentioned customers coming to you looking for the these kinds of um security features.

Uh what are you seeing out there in terms of both the maturity level for enterprises deploying agents and correspondingly the maturity level on governance? Yeah, it's it's weird. It's it's like a it's like a s simultaneous contradiction is what we're seeing. There is there are with without a doubt multiple, you know, many, many, many large organizations that are on the cusp of deploying agents into production.

Uh at the same time, you know, the there's when you dig into it, it's like what that sometimes there's confusion around what exactly they're gonna be deploying to production. So it's a it's kind of like talking out of both sides of their mouth. But That's the truth about any major technology transformation, right? There's there's a pressure to do something, but then when you're actually at the point of doing that thing, it there's always some second guessing.

There is one pattern though, which is the coding assistants are are everywhere. Cloud code, cursor, windsurf, um, codex. Those are those are massively proliferated throughout every enterprise right now. And we are we are seeing a uh common pattern of that being a risk in the sense of, you know, these assistants have access to your code base, your databases.

It's quite sensitive stuff. And so it does require a much higher level of of authorization and access control. And you know, all of the companies that are behind those tools are working on guardrails and governance. So what what's the role that a company like Okta plays or or or the need for something above and beyond that?

Well, it's funny. They are, but sometimes they're you know the guardrails that are being worked on are more in the realm of what I would call pure play AI. So it's to ensure the model doesn't lose its mind. Um the the reason you you know, the the reason there'll always be uh you know, n whether it's us or someone else, i i it has to do with independence and neutrality.

And it has to do with the fact that you From a from a cybersecurity perspective, you do want to separate out the authorization control plane from where the agent is actually running. That gives you what's called a layered defense strategy because then it's multiple hops. Then an attacker has to break through in order to get to the gold mine. If you put it all in one place, you are concentrating a risk.

If you spread it out, you're diversifying a risk. It's it's in in financial terms. And so that the the need for independent neutral control plane is is more important than ever. It's what We did for human identities when humans were connecting to SaaS, um, and still are, but it's what we are doing for agents connecting to resources as well.

And so separating it out from the frontier models, from the Asian runtimes is is actually a a smart move from a cyber risk perspective. For someone who isn't as uh technically familiar, what exactly does an authorization control plane mean? Yeah, it's as it's as simple as what can my agents access and what can they do? That's that's as simple as that.

So what can they access? Meaning, does every agent in your organization have a unique identity? And that matters because the regulators are gonna want auditing, logging, and and tracking of these agents at a transaction level. Um, you know, if you look at where the UAI act is going, Article 14 specifically calls for that, and that's gonna hit um all the companies in the EU very soon.

Um so that level of like independent agent identity is critical. but the second piece is for a given agent, centrally controlling what they can access and the access levels is also, you know, important from a regulatory perspective. So that that's one part of authorization. But the second part, which is actually I think more exciting is what can they actually do at runtime?

Which is this idea that when uh somebody prompts an agent to take to do something, One of the, you know, it's checking whether the intent of the user matches the actual action and checking for discrepancies is the future of conversation. That's what a control plane does. So for example, if you tell an agent, you know, clean this thing up, and what you meant was just move stuff into one one place, but they interpret it as delete, that's an intent mismatch. And so how do you have a control plane that can prevent that from happening before it's too late?

So that th that's what I mean by an authorization control plane is really getting to a fine what we call fine grained, dynamic, context based authorization is the holy grail of where we're where we're pushing towards. Let's take that example, the the clean this up. That that's not uh a situation where the agent would necessarily wrong. It seems like that's something where the user is under specified.

So it's it's it's it's essentially the similar to the alignment issues that the model developers are are having to wrestle with. So how would you address a situation like So a few different things. you would ensure that the one is at a at a coarse-grained level, the agent doesn't actually have broad-based rights into certain data sets. At a fine-grained level, you would introduce that context authorization I was referring to.

And then you would be, as a builder of the agent, you would also introduce human in the loop to ensure that before some super sensitive transaction is executed, you are doing the final check of. Hi, I'm about to delete. Do you approve? It's like, wait, wait, wait, wait, hold on, stop, stop, stop.

Now, human in the loop is tricky. If you introduce human loop everywhere, then it that you're not getting the benefits. Then you're just creating a really annoying intern that asks for permission for every action. Then it has no agency and therefore it is not an agent.

So you know, but it's a combination of coarse grain, fine-grained authorization, and then also human loop to to secure these potentially dangerous transactions. And the answer to that problem you described for human in the loop is identify a a uh limited subset of situations where it's money, updating a stocks control database, um, changing an address, something that something that you know that a regulator might might complain about, you know, if you if you're in financial services or healthcare.

but that's something that the designer of the agent needs to take into account up front. Back to the the first part that you were describing uh a minute ago. You talked about identity uh and and why that's important and and maybe required under under regulation. Uh how hard is it to identify agents?

Ah, so it it's not actually it's not hard per se. It's more about how fast can you get there? So the in in you know in cyber terms, we talk about it as being on the edge, living on the various edges. So let me give an example.

One way in which rogue agents creep into an organization is somebody just goes and on their work machine, they download clawed code or cursor. So now the question is how do you detect that? There are ways of detecting it. There are very, very robust endpoint, you know, softwares like CrowdStrike and Palo Alto and Janf for for the Mac universe.

And so, you know, it it it's part of what we're look doing is integrating with those guys to say you can you literally live at the OS level. So you should be able to detect if somebody installed clawed code, that's been that's unauthorized. And so you flag that, you give it an identity, and then you ensure that you bring it under control. That's one edge is the endpoint as we call it.

The other edge is the network. So there are, you know, vendors like Zscaler can that that literally live at the the the secure edge. They can sniff all the traffic as it's leaving going in and out of the company. And so there's patterns that can tell you if there's a genetic traffic or not.

but again, once you detect it, what do you do about it? The key is then you have to give it an identity, right? It's like you find a rogue, then you register them in the system. That's kind of what the the whole another edge is the browser, where if somebody goes and uses their credit card to get access to a some SaaS vendor that's cre that gives them an agent, you can put a plugin in the browser to sniff that out and then register that.

So the it's a multifaceted approach, but it's a little bit like law enforcement. Like you have to live at all the edges. Yeah. And then you gotta catch the crew, you know, catch the rogues.

and bring into the system. That's uh that's so i it it it is actually a collaboration between all the cyber vendors in in the in the to to make this work. Do you find that organizations are aware of this? That this is kind of the shadow agent problem?

And w what do they find when they they actually turn this on and they they see everything? So it's interesting. 100% awareness that there is shadow AI running around. uh but when you actually double click into it, what you realize is uh 20% of agents carry about 80% of the risk.

And so the question is you can discover every agent that's out there, but bringing those agents under control may get you no benefit. What mat that there's a certain set of agents, it and these are like the multiplayer enterprise agents, the ones that are Or the ones that are accessing sensitive resources. Discovering those and controlling those, even though they're small in number, they're big in risk. And the blast radius, as we say in cyber, in cyber to speak, is very high.

And so the this conversation is shifting from find everything to find the very dangerous ones. And those need to be brought under control. It's it's quality over quantity of discovery. you know, so what about the problem that that agents can spawn other agents?

How how do organizations maintain that identity in that environment? The notes from the field, if you will, are that's a that is a really good theoretical problem right now. Uh, but at scale, we don't see that happening yet. Now, the way to fix it though is if an agent is spawns a few ephemeral agents that are short-lived just to get some, you know, some specific tasks done.

Uh if if that is known behavior, then you can design it where. The each type of subagent gets its own identity and there's the canonical representation has an identity. So you know that it is it is allowed. But let's say that that you you want the agent to just run free.

Then what's important is you have authorization, where even if a subagent is spawned, when it's about to take an action, you have the final guardrail that says, excuse me, not allowed. And you log that. Right. So then the regulators are happy.

So authorization, that's why. We are so gung-ho on authorization, it becomes very critical. Um, especially for the dynamic agents or the ephemeral agents. Um, sub agents that are known, that are part of the design pattern, that's easier.

We just that's just A to A agent to agent as it's called. It's pretty, pretty straightforward. Right. What what's the you know biggest risk area that you're actually seeing out there i in organizations that they are It's the local, it's the desk, it's the laptop agents, the the coding assistants.

That is the you know the the most clear and present risk right now because they are the the level of access they have and the power that they have is incredibly high. So that that needs to be detected and shut down or or detected and controlled right away. We don't want to shut it down. They're fantastic tools.

You know, we're we're big fans of all the the coding assistants, but they have to be controlled properly. Otherwise there could be unintended behavior. And at at this point are those risks more in the the domain of the, you know, this accidentally deleted my production database or uh external kinds of threats like prompt injection? No, they can be prom projected because remember, these coding assistants are not just for developers.

They're essentially giving you the power of the frontier model in a command line interface. And so, you know, you can you can imagine a world where somebody, you know, is is a victim of a phishing attack or some kind of social engineering where they accidentally, you know, uh obtain a markdown file that contains malicious instructions in there. Right. because it's all text.

So You know, you you accidentally, you know, uh put in the wrong MD file into a skill that has been poisoned. So that's model poisoning, you know? Um, that is a very real risk. And it's not just in the realm of developers.

Civilians that are using these frontier models this on your on your terminal are s are probably more susceptible to these risks. You mentioned a couple of standards already, like MCP and and A2A. D do we have the the standards that we need fully in this environment or are there missing pieces? No, no, no.

Um MCP is is, you know, it's a really good wrapper on APIs and it allows any owner of resources to expose their tool calls, as they're as they're now called, in a in a standardized way. Great. A to A being another one for you know that helps with agent discovery and showing the agent card and all that's fine. But from a security perspective, there is there's still room for Things like universal agent identity.

So in a in a future where every organization is creating their own agents and they're crossing trust boundaries, how does an what is an agent's passport? Or like every website has a unique IP that's resolved by the DNS authority. What is a agent's DNS resolution? Right.

So there's that is a one standard. The other one is ah You know, if if you say if you truly want a uh agentic mesh where every organization's agents talk to every other organization's agents, um, identity has to transcend the identity issued by a single identity provider like us. You need a way for an agent to carry a cryptographically provable device or user-bound identity with what's called D Dpop demonstrated proof of possession, to say that you are actually acting on behalf of someone that crosses trust boundaries.

So there are certain standards. Now now I'm gonna get very nerdy. There are certain standards like Spiffy, Inspire, or NTLS that you know, that that that can start to do that, but they need more widespread adoption. So we have by no means landed on the full set of standards that we need.

It's it's still a work in progress. Yeah. Do you see that that universal Asian identity being a realistic possibility? Is it's it's partly a technical issue, but partly it's it's a just a very hard coordination issue to get everyone to agree.

Yeah, yeah. Standards are hard. Standards um well, standards are easy to define and hard to adopt. and and we we are very familiar with that.

We as a company, our our DNA is all about find a problem, solve it internally, figure out the common pattern, bring the others along, make a standard, then bring the industry along. Now, the last two steps take a lot of time. there's a standard that really led to the growth of identity called SAML. And SAML took many, many years to adopt.

And sometimes I think we ourselves forget that it took us, you know, 10 years to get here. So we can push all the standards we want in in AI. And there's a right thing to do, but it takes time and and adoption and you know, um with AI, what's interesting is the the there's such a tremendous pressure to realize ROI and and positive outcomes that people are taking shortcuts. And one of the shortcuts is don't bother with the standard, just get it done somehow.

Yeah, although it's interesting, you know, with uh not entirely the same thing, but with MCP, Anthropic put it out there and suddenly all their competitors adopted it and it's become fairly ubiquitous, at for those tool calls. Yeah. And and because it was a blocker to the core the the most core value that agents would provide, the security part of it will take longer. And this is always the the tension between innovation and security.

Right. Like you want to innovate, but then as you innovate, you might introduce risks. But you know, developers will like, or whatever, don't bother me with all this. I just want to get this cool agent out there.

Mm-hmm. You know, security guys get on our way. Kinda. So there's there's always that tension.

Yeah. you mentioned earlier the the EU AI Act and some of the requirements that it's going to put into place. more generally, how do you see regulation impacting on these developments you've been talking about? Yeah.

The the the biggest thing is gonna be attribution, um, or or or traceability, right? Or accountability. Come up with, you know, whatever big word you want. Is the idea that can you prove that an action that was taken by an agent within a company was on behalf of a user, if so, which user?

And if so, why? And if it did happen, did you have all the right controls in place to prevent a potentially bad action? Like all proving all that is is gonna I I see that as being a big cottage industry for the auditors. and and the way you do that is the only system that can do that is the one that's in the what we call inline.

It's inline in the flow from user to agent to resource, which is identity. So that so the the that's the trend that we one big trend that we expect to see from a regs perspective. The other one is kill switch, is this idea that can you halt this agent's activities instantaneously if breach is detected? Which also requires a central authorization control plane.

Because then you have one it's the faucet. You just turn off the mains at the in the basement of the house and that agent is is shut off. Um, a lot of that though assumes that there is something like an audit requirement and in financial services we've got this whole infrastructure and you can't you know you can't file your quarterly numbers without getting them audited. Um, are we going to go to that point where there's mandatory audit requirements are gonna have to pull enterprises to to put all these things into place?

Yeah. Like the way you normally the way you see it is um like MIST or one of the the government authorities will usually put out their position on it. And so we're actually working with them to formalize kind of what is the what are the right architectural considerations for agentic security. Those will then be adopted into states state specific and federal regs.

Um and it might even, you know, it might end up being based on what the EU is doing. Because the EU is always at the forefront with regs. And so you can kinda see that in f you know, flowing into maybe SOX or NYDFS two hundred or wherever they are, um and and influencing those. But I think it's it starts with the with the definition of the right even frameworks and standards, which NIST plays a big role in.

Mm-hmm. So one thing I want to ask you about is in the US, we don't have a lot of uh certainly federal AI regulation, but we do have a lot of litigation in the US. Uh and to what extent i is it possible that the need to attribute when things go wrong and someone is suing might drive companies to deploy some of these capabilities? Yeah.

I I think I think I mean, without even being as I guess morbid as getting sued, uh we are we are definitely seeing that boards are asking their CEOs and and chief security officers to put agentic guard rules in place now because they're almost looking at it as an uh looking at it as an insurance policy. Now I I can't speak to how cyber insurance rates are changing and those are, you know, that wall is changing, but um, I don't think we have to wait for something legal to happen.

Like this is this is a mandate from boards right now to pretty much, you know, for in the Fortune 500 to all of the like from I would I guarantee you this is a this is a topic in every security review that that that's happening in all those firms. So overall, how do you see this market evolving? You know, it'll follow some usual ebbs and flows of and it will it will stabilize. not not saying Gartner hype cycle or or pick pick your pick your sigmoid type graph, you know, for for this.

Um I do predict though that this this can be bigger than uh cloud and and s and SaaS um overall, just because the the productivity gains are are phenomenal and then they compound. Because as they get better, they can make themselves better. And there is that whole like the true generative, you know, agents. so the the what that means is the pie overall of the identified economy is huge, which means all the sub players will all each of their pies will grow as well.

And in particular with regard to the security piece of it, how does that uh world look to you as it goes forward? I think the I think that the the end a lot of cybersecurity is based on the some this thing called zero trust, which is this idea that you know you need to trust but verify at every at every um layer of the stack and then every system to system. But it was based on humans attacking humans. It was never based on humans delegating to agents that might take do crazy things or agents attacking agents.

And so the the I think there's going to be a big toss-up for who's going to own the future of Zero Trust. The, the, you know, the signals are the same. They're coming from devices, from endpoints, from cloud management, from browsers. But who processes the signals, who makes the decision of increasing, you know, authorization guard rules or whatever in flight, that's going to change.

So I think it's going to be a big toss-up. Um, and I do think there's there's going to be a kind of a a redefinition of of what what is zero trust architecture for agent tech look like? Harish, thank you so much. Really been a pleasure being with you.

Yes, likewise, thank you so much. This has been the Road to Accountable AI. If you like what you're hearing, please give us a good review and check out my Substack for more insights on AI accountability. Thank you for listening.

If you want to go deeper on AI governance, trust, and responsibility with me and other distinguished faculty of the world's business school, sign up for the next cohort of Wharton's Strategies for Accountable AI Online Executive Education Program. Featuring live interaction with faculty, expert interviews, and custom-designed asynchronous content. Join fellow business leaders to learn valuable skills you can put to work in your organization. Visit execed.

warden.upen.edu slash acai for full details. I hope to see you there.