It’s hard to believe we’re already kicking off season Two of Ready. Or Not. But considering how quickly AI is evolving, maybe it shouldn’t be surprising at all. Since our last season, the conversation has shifted from what AI might do to what AI is already doing inside many organizations. With every new breakthrough comes a new set of questions for leaders to navigate.
We start this season with a question about digitalidentity trust and security: What happens when AI starts acting on our behalf?Watch the full episode on Readiverse.
Key Takeaways
- Most organizations are exploring AI, but many are not prepared for the identity and security challenges that come with autonomous agents.
- AI agents are operating on behalf of humans, creating new questions around authorization, accountability, and digital trust.
- Identity is no longer just about authentication. It’s becoming the foundation for securing AI-powered interactions.
- Organizations must balance innovation and risk as AI adoption accelerates.
- Strong identity hygiene, modern authentication, and clear governance can help organizations prepare for what’s next.
AI Is Evolving – Is Your Security Keeping Up?
In this first episode of the season (S2:E1), Nathan Macintosh sits down with Eve Maler, digital identity pioneer, standards leader, and author of Mastering Digital Identity: From Risk to Revenue. Their conversation explores a challenge many organizations haven’t fully addressed yet: how identity, authorization, and trust need to evolve for a future shaped by AI agents.
As Eve explains, AI is no longer just generating content or answering questions. Increasingly, AI agents are connecting to systems, making decisions, and completing tasks on behalf of users. While this creates tremendous opportunities for productivity, it also introduces questions around trust and accountability.
But Eve doesn’t frame AI as something organizations should fear. Instead, she focuses on understanding the tradeoffs and preparing identity systems for a reality that’s already begun.
Meet Your New Identity
One thing that’s clear from this conversation is that identity is no longer just about humans. In the past, it was about people logging into systems and proving they were who they claimed to be. But AI agents are changing that. Now we’re asking AI to access applications, connect systems, gather information, and complete tasks on our behalf.
Eve explains that these agents don’t fit into the identity categories we’ve traditionally used. They’re not human, but they’re not just machines either. They’re operating somewhere in between, with the ability to mimic human actions and decision-making.
Nathan playfully refers to these digital representatives as “shadow men.”
“The AI is basically taking you and being your representative out there.”
– Nathan Macintosh
That’s something many organizations aren’t quite ready for yet. If an AI agent is acting on your behalf, how do you know what it’s authorized to do? How does your organization distinguish between actions taken by a person and actions taken by an agent? And if something goes wrong, who is ultimately accountable?
Sneak Peek: The Great Impersonator
We trust AI to help us write emails, schedule meetings, and find information. But what happens when it starts doing those things as us? In this clip, Nathan and Eve explore howidentity and access management (IAM)is evolving, making it harder to tell where automation ends and authority begins.
When the Shadow Man Goes Rogue
Imagine asking an AI agent to help streamline a business process. You give it access to the systems it needs, and it goes to work. But what happens if it acts in a way you never intended? Suddenly, the question isn’t whether the AI knows who you are. It’s whether it had the authority to do what it just did.
The distinction matters because AI agents can operate with the same access, permissions, and privileges as the people they represent.
“The agent has infinite time and infinite patience and does things really fast with your permissions.”
– Eve Maler
That’s why Eve stresses the importance of having guardrails that define exactly what actions it can and cannot take. An AI agent shouldn’t simply inherit a user’s identity and have free rein. As organizationsdeploy more AI agents, they’ll need to think beyond identity verification and focus on authorization: how it’s granted, limited, and monitored over time.
Opportunity and Risk Are Growing Together
At some point in nearly every Ready. Or Not. episode, the discussion turns to risk. This episode is no exception. But what stood out was how the conversation shifts from what organizations should fear to what they stand to gain.
“So, it’s not just a problem. It’s a problem and an opportunity.”
– Nathan Macintosh
Every new technology introduces challenges, but it also creates opportunities for organizations willing to adapt. According to Eve, the goal isn’t to eliminate risk. It’s to understand it while still pursuing the value AI can deliver.That perspective mirrors what we’re seeing across industries today. Organizations aren’t asking whether AI will become part of their future. They’re trying to determine how quickly they can adopt it while maintaining trust and resilience.
What Organizations May Be Missing
As organizations start putting AI agents to work, Nathan asked Eve an important question: Are they ready for what’s coming next?
“I would say most organizations think they’re partially ready, and most organizations are not ready at all.”
– Eve Maler
According to Eve, many organizations are eager to deploy AI agents, yet they haven’t fully addressed the identity, access, and governance challenges that come with them. What may have been manageable in a human-centric environment becomes much more difficult when AI agents can act at machine speed and scale.
The good news is that readiness doesn’t require an entirely new security playbook. In many cases, it means doubling down on the fundamentals that identity teams have been working toward for years. Organizations should be thinking now about how to strengthen authentication, reduce reliance on passwords, improve authorization controls, and establish clear delegation models for AI agents.
Ready or Not: The Next Wave
Ready. Or Not. conversations always leave me thinking about technology differently, and this episode certainly did.
When many of us think about AI readiness, we immediately focus on models, data, infrastructure, or governance. Eve reminds us that identity deserves a place on that list.
As AI agents become increasingly capable and autonomous, organizations should develop new ways to establish trust, assign authority, and maintain accountability. Because the future won’t be defined solely by what AI can do. It will likely be defined by how confidently organizations can trust AI to act on their behalf.Watch the full episode on Readiverse.
FAQs
Q: What is a non-human identity (NHI)?
A: An NHI is a digital identity assigned to a machine, application, service, or automated system. As AI agents become more autonomous, organizations are increasingly treating them as a new category of NHI because they can take actions, access data, and interact with systems without direct human involvement.
Q: How do AI agents create new identity challenges?
A: Traditional identity programs were designed around people and machines as separate categories. AI agents blur those lines. They can act with machine speed while making decisions that resemble human behavior, creating new questions around authority, accountability, and governance.
Q: What’s the difference between authentication and authorization?
A: Authentication answers the question, “Who are you?” Authorization answers, “What are you allowed to do?” According to Eve, organizations have spent years focusing on authentication, but AI agents make authorization increasingly important because agents may inherit permissions and act independently within those boundaries.
Q: What role does trust play in agentic AI?
A: Trust is becoming a foundational requirement for AI adoption. Organizations need confidence that AI agents are operating with the appropriate authority, accessing only the resources they need, and acting within defined guardrails. Without that trust, scaling AI can become difficult.
Q: Do organizations need an entirely new security model for AI?
A: Not necessarily. One of Eve’s key points is that many of the practices organizations need are already familiar: strong authentication, modern identity management, authorization controls, and clear governance. The difference is that AI adoption increases the urgency of implementing them.
Q: What’s the biggest takeaway from this episode?
A: AI readiness isn’t just about having access to the latest models or technologies. It’s about ensuring the identity and trust frameworks behind those technologies are mature enough to support an increasingly autonomous future.
Katherine Demacopoulosis Senior Director of Global Content Strategy and Programs at Commvault.
