Q1: What's Different About AI Agent Identity?

You're speaking at The AI Summit New York on securing identity in the age of AI agents.

For organizations that have spent decades perfecting traditional IAM frameworks, what's fundamentally different when AI agents start interacting with enterprise systems on behalf of users?

Asim Khwaja (AK): Traditional IAM assumes that a human user or a relatively predictable service account sits behind an identity. AI agents change that because they can interpret goals, make choices and initiate actions across multiple systems.

That means identity alone is no longer enough; organisations also need to govern delegated authority. An agent should have a clearly defined identity, a specific purpose, bounded permissions and an auditable link to the person or process on whose behalf it is acting.

Credentials should be short-lived where possible, privileges should be minimised, and authority should be revocable quickly.

The shift I would emphasise is this: AI security is moving from protecting what a machine knows to controlling what a machine can do.

Q2: Who's Responsible When AI Acts Autonomously?

In your session, you'll be exploring how organizations are adopting new approaches to delegated authority when AI acts on users' behalf.

What frameworks are security leaders implementing to ensure accountability when an AI agent makes decisions or takes actions autonomously?

AK: Accountability should remain human and organisational, even when execution becomes increasingly autonomous.

The practical challenge is to make delegated authority explicit rather than implicit. Organisations need to know who authorised the agent, what objective it was given, which systems and data it may access, what decisions it can make independently, and when escalation to a human is required.

That should be supported by strong logging, traceability and review mechanisms so that actions can be reconstructed after the fact. I would also separate responsibility for design, deployment and operational oversight rather than allowing accountability to disappear between teams.

Capability can be delegated to an AI agent; responsibility cannot. The more consequential or irreversible the action, the stronger the controls and human oversight should be.

Q3: Balancing AI Agent Power with Security

Agentic AI systems often require elevated permissions to perform their functions effectively, yet this creates significant security risks.

How are security leaders giving agents the access they need without creating massive security risks?

AK: The answer is not to give agents broad standing privileges simply because they may need to act quickly. A better model is bounded, contextual authority.

Organisations can combine least privilege with just-in-time access, task-specific permissions, approval thresholds and rapid revocation. An agent that can read data does not automatically need the ability to modify it; an agent that can recommend a payment does not necessarily need authority to execute one.

Security teams should also think in terms of blast radius: if the agent is compromised, manipulated or simply wrong, how much can it actually affect before controls intervene?

The goal is not to remove autonomy, but to make autonomy proportional to consequence and reversibility. That is how security becomes an enabler of trusted scale rather than a brake on adoption.

Q4: Agent Permissions and the New Trust Boundary

When an AI agent interacts with sensitive enterprise data or critical systems, who is ultimately accountable?

How are organizations establishing clear lines of accountability and audit trails in agentic AI environments?

AK: When an agent acts on behalf of a person or organisation, the trust boundary expands beyond the model itself to include the identity, credentials, tools, APIs and systems that the agent can reach.

Accountability therefore depends on being able to reconstruct the chain of authority: who initiated the task, which agent acted, what permissions it held, what information it used and what action followed.

That requires durable audit trails, strong identity controls and clear ownership of the business outcome. It also means distinguishing between an agent being technically able to do something and being authorised to do it.

In practice, organisations should design for attribution from the outset. If an important action cannot later be explained, traced and, where necessary, reversed, the control model is not mature enough.

Q5: AI Governance Meets Cybersecurity

Drawing on your broader experience across cybersecurity, AI governance and organisational resilience, where do you see the biggest gaps between AI governance frameworks and practical cybersecurity implementation?

AK: The biggest gap is often between governance expressed as policy and governance implemented as operational control.

Many frameworks are good at defining principles such as accountability, transparency and human oversight, but security teams still have to translate those ideas into identities, permissions, logging, testing, monitoring, incident response and recovery.

Another gap is ownership: AI may sit across technology, data, cyber, legal and business teams, so risks can fall between organisational boundaries.

I would therefore focus less on creating another layer of documentation and more on asking whether the governance requirement changes how the system is actually built and operated.

Governance that does not reach deployment is just documentation. The strongest programmes connect policy, engineering and assurance so that controls can be demonstrated rather than merely described.

Q6: The Convergence of AI and Quantum: 

Implications for Cryptography and Digital Trust As the author of Convergence of AI & Quantum, you are uniquely positioned to explore how quantum computing will influence the cryptographic foundations and digital trust infrastructure underpinning AI systems.

Looking ahead to the next 12–24 months, what practical steps should security leaders take now to prepare for the longer-term transition to post-quantum cryptography and protect the digital-trust infrastructure on which AI systems depend?

AK: I would start with preparation rather than prediction.

Organisations do not need certainty about when cryptographically relevant quantum capability will arrive before taking sensible steps now. The priorities are to understand where cryptography is used, identify data that must remain protected for many years, map critical dependencies on vendors and protocols, and build crypto-agility so algorithms can be changed without major disruption.

Security leaders should also follow recognised post-quantum standards, begin testing migration paths in appropriate environments and make quantum readiness part of normal technology lifecycle planning.

The key point is that quantum risk is a migration problem before it becomes a decryption problem. Large estates take years to change, so the practical advantage comes from knowing what must move, in what order, and why.

Q7: Securing Agentic AI Across Critical Infrastructure

From a broader cyber-risk and resilience perspective, what are the unique security and assurance challenges when deploying agentic AI systems in high-stakes environments like energy grids, financial systems, or government services?

AK: In high-stakes environments, the central issue is consequence.

An agent that makes a poor recommendation is very different from one that can alter a payment, change an industrial process or affect access to an essential service. That means assurance has to extend beyond model accuracy to authority, dependency, containment and recoverability.

Organisations should know what the agent can reach, what happens if it behaves unexpectedly, how quickly its authority can be removed, and whether the wider service can continue safely without it.

Human oversight also needs to be calibrated to consequence rather than applied uniformly.

At machine speed, a bad decision can scale as quickly as a good one. The objective is therefore not simply to prevent failure, but to limit blast radius, degrade safely and recover quickly when something does go wrong.

Q8: Moving Fast Without Breaking Security

AK: Many organisations are racing to deploy AI agents to stay competitive, but rushed implementations can create security debt and other risks.

What’s your advice for security leaders who are being pressured to approve agentic AI deployments faster than they can secure them?

Security leaders do not have to choose between moving quickly and maintaining control.

The practical answer is to match the level of autonomy to the consequence and reversibility of the action. Low-impact, easily reversible use cases can move faster; high-consequence actions should require stronger testing, tighter permissions and additional approval or monitoring.

I would also favour staged deployment: start with observation or recommendation, then progressively delegate action as evidence builds.

Minimum controls should be non-negotiable from the beginning — identity, least privilege, logging, monitoring, clear ownership and a way to stop or revoke the agent.

A successful AI pilot proves the use case. It does not prove the organisation is ready to depend on it. Speed becomes sustainable when control and recovery are designed in from the start.

Q9: Building Security into Agentic AI from Day One

What are the non-negotiable security and governance controls that must be built into agentic AI systems from the design phase?

Where do you see organizations trying to bolt on security after deployment, and why does that approach fail?

AK: I would treat five controls as foundational: identity, bounded authority, data protection, observability and recovery.

Every agent should have a distinct identity; permissions should be limited to the task; sensitive data should be protected throughout the workflow; important actions should be logged and monitored; and there should be a tested way to contain, revoke or recover when behaviour is unsafe or unexpected.

Security also needs to be part of architecture and testing, not an approval gate added just before launch. Once agents are deeply integrated with APIs, credentials and business processes, retrofitting controls becomes far harder because the dependency has already formed.

Security by design is therefore not about slowing deployment. It is about making sure that the organisation can understand, constrain and recover from the system before it becomes operationally critical.

Q10: The Future of AI Security at The AI Summit

As you prepare for your session at The AI Summit New York in December, what's the one message you most want security leaders, AI practitioners, and enterprise decision makers to take away?

What should attendees be thinking about as they plan their 2027 AI security strategies?

AK: The message I would most like leaders to take away is that the next phase of AI security is about dependency and authority, not only model performance.

As organisations move from experimenting with AI to relying on agents inside real business processes, they need to know what those systems can do, what they depend on and how the organisation continues if they fail.

For 2027, I would prioritise identity and delegated authority for agents, visibility of AI dependencies, security-by-design, continuous monitoring and tested recovery. Organisations should also distinguish carefully between systems that assist people and systems that can initiate consequential actions.

The question is no longer simply, “Does the AI work?” It is increasingly, “Can we trust it to act, can we limit it when necessary, and can we operate safely without it?”

Conclusion

The shift from AI experimentation to operational dependency demands a fundamental rethinking of security, governance, and accountability. As Asim Khwaja makes clear, the question is no longer simply whether AI works, it's whether organizations can trust it to act, limit it when necessary, and operate safely without it. 

Security leaders must move beyond protecting what machines know to controlling what they can do, building identity, bounded authority, and recovery into AI systems from day one. As agentic AI scales across enterprise infrastructure, the organizations that succeed will be those that design for consequence, not just capability.

Make sure you join us for Asim's session: Who Has Access? Securing Identity in the Age of AI Agents, taking place on Wednesday December 9, 2:30pm, AI Cybersecurity stage.