Lifecycle, Privilege & Auditability

Identity and access management has spent thirty years answering one question extremely well: who is allowed to read or write this resource. That question is necessary for AI agents and it is nowhere near sufficient, because an agent's authorization is stable while its instructions are not. The same agent, holding the same entitlements, will do completely different things depending on what turned up in a retrieved document, a support ticket, or an email it was asked to summarize.

Prompt injection is usually discussed as an AI safety problem. It is better understood as an identity problem, and specifically an integrity problem. The Biba model described this in 1977: data from a low integrity source must not influence a high integrity operation. That is exactly what happens when untrusted retrieved content reaches a privileged tool call.

In this session I will walk through applying integrity labeling to real agent pipelines. How to label sources, how taint propagates through context windows and multi agent handoffs, where the lattice breaks down in practice, and how to enforce a no write up rule at the tool boundary rather than trying to filter inputs. I will show a working taint propagation implementation and a case where it stops an injection that content filtering does not.

The argument I want to leave you with is that integrity labeling belongs in the identity fabric, alongside authentication and authorization, and not in a separate AI security product.

The procedures for limiting AI-agent delegation will be shipped by mid-2026. Microsoft Entra Agent ID is generally available as of April 2026, with Conditional Access policies for on-behalf-of and autonomous agents as of June 2026; OAuth 2.0 Token Exchange (RFC 8693), On-Behalf-Of flow, SPIFFE/SPIRE are all production-ready; NIST is launching an AI Agent Standards Initiative as of February 2026. Yet not one binding governance, risk, and compliance (GRC) frameworks   SOC 2, NIST CSF 2.0, ISO/IEC 27001:2022, NIST SP 800-53 Rev. 5, or the legally binding Digital Operational Resilience Act (DORA), requires bounded, time-limited, audited agent delegation. This paper makes that lag measurable: a stacked, control-by-control assessment of five frameworks across five NHI governance dimensions on a published Covered/Partial/Silent rubric, with every gap mapped to the MITRE ATT&CK technique it leaves exploitable. The analysis is anchored by two checkable findings. The NIST SP 800-53 IA-9 identity control was written for services, but it is assigned no baseline in SP 800-53B, so the right control is never required. The absence of agentic delegation in DORA rules out the claim that frameworks will simply mature into coverage. We characterize the transitive delegation gap for AI-agents as a primitive. We validate one RFC 8693 control that breaks a working kill-chain. We position the contribution against the mechanism and standards work that moved the field on in 2026. The gap is not what is possible; it is what is mandatory.

As organizations move toward autonomous operations, identity becomes the foundation of trust between people, machines, services, and AI. This panel explores how identity, cybersecurity, governance, and cryptographic trust come together to enable secure, resilient, and intelligent digital ecosystems.