Identity governance must accommodate changing relationships among people, institutions and technology. Vanderbilt University sees that complexity deepening as artificial intelligence agents enter institutional workflows.

Vanderbilt uses OneVU, powered by Okta, for single sign-on. Its broader environment includes residential life, athletics, its own police department and more than $1 billion in research. That breadth complicates access decisions, according to Shane Callahan (pictured), chief information officer of Vanderbilt.

“When it comes to [a] university, you could have multiple identities and sometimes at the same time,” he said. “For me, I’m a student, I’m a staff member, [I] could be a donor — all these different things — and they all have different profiles of how you work at a university. Keeping track of that security profile is very, very difficult.”

Callahan spoke with theCUBE Research’s Krista Case and co-host Rebecca Knight at Okta’s Oktane event, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed changing identity requirements, AI agent accountability and cross-functional governance. (* Disclosure below.)

Identity governance confronts agent accountability

Agents add another layer to identity security. Distinct identities and scoped access can limit what they do, but they don’t resolve who bears responsibility for their actions, according to Callahan.

“If you have an agent that does something and it goes outside of your guardrails, are you accountable for that or is the tool accountable for that?” he said. “What happens if that tool gets out of guardrails and impacts another group or another company? Does cyber insurance help us with that? We don’t understand where liability or responsibility falls at this point.”

Organizations don’t need to discard established oversight mechanisms to address those risks. Identity governance can build on existing technology-intake processes and cross-functional governance, Callahan explained.

“We’re treating AI like it’s a brand-new thing. But really, you’re still talking about identity data in another technology tool,” he said. “You don’t have to recreate everything. If you have a governance process and a technology intake program, do that, use that.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of Okta’s Oktane event:

(* Disclosure: TheCUBE is a paid media partner for Okta’s Oktane event. Neither Okta, the sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE