Delinea Addresses AI Agent Security with Real-Time Authorization Solution

Delinea Inc. is developing solutions to address the evolving security challenges posed by artificial intelligence agents integrating into sensitive corporate systems. The company's approach focuses on real-time authorization and enhanced auditability, aiming to manage these new digital entities without hindering productivity within an enterprise.

Traditional identity and governance frameworks were designed for consistent human users or well-defined machine identities. However, AI agents introduce a different dynamic, capable of rapidly generating temporary identities, accessing multiple systems, and then ceasing to exist upon task completion, according to Delinea CEO Art Gilliland. He noted that conventional methods of gaining visibility and setting policies are ineffective for AI, suggesting a need for a fundamentally different strategy.

Gilliland highlighted these points during an interview with Krista Case at Black Hat USA, broadcast on theCUBE. The discussion centered on enhancing AI agent security through real-time authorization and eliminating persistent privileges, all while preserving enterprise operational efficiency. He explained that attempting to identify, provision accounts for, and issue credentials to every AI agent would be impractical for organizations.

The company's strategy involves concentrating on the critical assets within an organization. This means identifying where sensitive data resides and which systems AI agents will interact with. The objective is to secure agent activities without impeding operational speed.

A crucial aspect of this new methodology involves distinguishing between human access and an AI agent operating with a person's credentials. This distinction allows for the application of varying permissions and the real-time evaluation of each agent action. Such a level of scrutiny provides a comprehensive audit trail, recording and monitoring agent behavior for compliance purposes, a significant departure from previous approaches.

Real-time authorization integrates directly into the protocol stack, offering a complete record of agent activities. Unlike static access controls, this system can identify patterns across different sessions, providing benefits for security, compliance, and business operations. Gilliland emphasized that this method allows businesses to innovate quickly without introducing vulnerabilities.

Granting access at the initial entry point is insufficient because the primary risks emerge from subsequent AI agent actions. Gilliland explained that an AI might autonomously search through files, such as those in SharePoint, locate additional credentials, and use them to escalate its own privileges. He contrasted this behavior with humans, who typically would not scrutinize every file, and traditional machines, which operate with more discrete instructions.

The CEO concluded that this non-deterministic behavior, combined with machine capabilities, necessitates real-time authorization rather than just front-door access control. This system is designed to continuously monitor and validate an AI agent's actions as it operates within the enterprise environment.