Category: Industry Insights

PAM is changing as AI agents, workloads and machine identities take on more privileged access.
Personal agents are about to test whether enterprises know who, or what, is using their credentials.
Secrets managers still matter. But AI agents and workloads are changing when stored credentials make sense.
Broad credentials made sense when fixed application logic stood between users and actions, but AI agents have changed that equation.
What began as a way for agents to call tools is expanding into infrastructure for longer-running, governed interactions across enterprise systems.
Centralized authorization eliminates repeated user consent, but autonomous agents still need runtime policy, short-lived credentials, and audit.
An employee, a scheduled agent, and a company-wide assistant may knock on the same MCP server door. They should not get in with the same badge.
OIDC adds identity to OAuth, giving applications a standard way to verify users, receive claims, and support modern sign-on.
Stateless requests, explicit state, and routing metadata bring familiar distributed-systems patterns to agent infrastructure at scale.
The gateway label now covers several very different jobs. The useful question is what traffic each gateway handles, what decision it supports, and where identity and access fit in the architecture.