Identity Crisis: IAM's Wild Ride in the AI Jungle

Identity Crisis: IAM's Wild Ride in the AI Jungle

Speakers: Sarah (Identity Researcher and Open Source Contributor)

Conference: BSides Seattle

YouTube: https://www.youtube.com/watch?v=DnG3vBDp92Y

Overview

The identity community is building under fire. With the ratio of non-human identities (NHI) to humans reaching 144:1 in H1 2025 (up from 92:1 just a year earlier) and 44% year-over-year growth, traditional identity frameworks are crumbling under the weight of agentic AI. In this talk, the speaker walked through the three most important emerging standards for securing non-human and agent identities: SPIFFE for workload authentication, Client ID Metadata Documents for dynamic OAuth client registration, and Cedar for mathematically provable authorization policies.

The talk is notable for its honesty: these standards are early, not widely adopted, and most agentic identity flows today are still static, overpermissioned API keys. But the speaker demonstrates through both technical depth and a live experiment — an autonomous OpenClaw agent named "Claudrey Hepburn" running on a Mac Mini with its own Google Workspace, Cedar-gated tool access, and a prepaid Visa card — that the building blocks for secure agent identity infrastructure exist and are being actively developed within the CNCF and IETF communities.

The fundamental challenge is stark: FIDO2/passkeys assume a human (biometric scan, PIN entry, physical touch), yet the identity community now needs to authenticate entities that cannot do any of those things. The speaker quoted Andrew Shikiar: "We spent the past dozen years contemplating how to prevent bots from authenticating, and now we have to figure out how to enable them to authenticate."

Background

▶ Watch: NHI explosion: 144:1 machine-to-human ratio with 44% YoY growth (0:20)

The identity landscape has shifted dramatically. Non-human identities now outnumber human identities 144:1, with vast overpermissioning — entities that should be reading email have read access to entire servers. Nearly half of all NHIs are over a year old, and one in a thousand is over a decade old. These identities do not have managers to approve access, do not onboard through HR, and do not offboard through HR.

FIDO2, the standard that finally solved human authentication with passkeys, explicitly requires a human in the loop. The standard mandates biometric scans, PIN entry, physical touch, and user consent. AI agents cannot perform any of these actions, creating a fundamental gap in the authentication stack.

The speaker referenced the 1992 film "Sneakers" as the earliest deep fake she knows of — the scene where a voice recording is used for authentication ("My voice is my passport. Verify me.") — to illustrate that the identity community was already dealing with authentication spoofing before deep fakes made it critical. With deep fakes rendering voice and video authentication unreliable, the identity community has abandoned those modalities entirely.

Key Findings

▶ Watch: SPIFFE: workload authentication via creator attestation and SVIDs (4:00)

SPIFFE for Workload Authentication: The Secure Production Identity Framework for Everyone (SPIFFE) provides authentication for non-human identities without long-lived secrets. Instead of trusting the workload itself, SPIFFE trusts the thing that created it (Kubernetes, AWS, Azure). The creator prints a "birth certificate" (SVID — SPIFFE Verifiable Identity Document) that includes the workload's purpose (e.g., "accounting tool intended to read salaries"), and the workload uses this to establish mTLS connections. Workloads may be ephemeral, lasting only 5-10 minutes. The reference implementation is called Spire, a CNCF project with active contributors, adopted at several companies but not yet in any AI protocols.

Client ID Metadata Documents: OAuth's dynamic client registration solved the problem of applications registering themselves just-in-time, but the explosion of vibe-coded apps hitting app stores created millions of registered clients on authorization servers. Client ID Metadata Documents allow an OAuth client to host metadata about itself at a URL, including name, key material, and critically, attestations from trusted sources (e.g., Apple App Store attesting "this is in fact an instance of the Claude Code app"). This enables just-in-time registration with granular, cryptographically verifiable trust.

Cedar for Authorization: Cedar, a policy language built and open-sourced by AWS (now in CNCF), provides human-readable, machine-analyzable, and mathematically provable authorization policies. Cedar policies are structured (not freeform strings), enabling formal verification that statements like "no one outside the finance department has access to credit card numbers" hold across all use cases — not through sampling, but through mathematical proof. This is fundamentally superior to putting guardrails in the prompt, which is probabilistic, vulnerable to prompt injection, and degrades with recursion depth.

Policy-Aware Agent Loops: Research by Phil Windley proposes a deny-replan loop where agents propose tool actions, Cedar's Policy Decision Point (PDP) evaluates them, and denied actions force the agent to replan rather than fail. This provides deterministic, external guardrails for agent tool use that are mathematically provable.

The "Claudrey Hepburn" Experiment: The speaker runs an autonomous OpenClaw agent named Claudrey Hepburn on a Mac Mini with its own Google Workspace, phone, and prepaid Visa card. Every tool invocation goes through a Cedar runtime MCP proxy for authorization. Claudrey is researching provably safe agent authorization, has submitted a talk to CloudSec Forward, and is writing a paper for SinSeek (a conference that only accepts papers where the first author is an agent). Claudrey also spawns sub-agents with lower trust levels, hinting at hierarchical trust architectures.

Technical Deep Dive

▶ Watch: Cedar: mathematically provable authorization policies for agents (10:00)

SPIFFE Architecture: When a workload starts (potentially ephemeral, lasting minutes), it is attested by its creator (the Kubernetes scheduler, AWS, Azure). The creator issues an SVID that encodes the workload's identity and purpose. The workload can then obtain JWTs or certificates to establish mTLS with other services. The SVID specifically mentions the purpose of the workload, enabling downstream systems to verify not just identity but intent ("this is an accounting tool supposed to be here asking these questions"). SPIFFE uses the client_id claim in OAuth tokens for its SPIFFE ID.

OAuth Dynamic Registration Problem: Dynamic client registration enables applications to register themselves with authorization servers on-the-fly. When AI-generated apps flooded app stores, authorization servers faced directory explosions with millions of registered clients. Client ID Metadata Documents solve this by letting clients host their own metadata at a URL, including attestation chains (e.g., Apple App Store cryptographic proof). Authorization servers can then make trust decisions based on verifiable metadata without maintaining massive client directories.

Cedar Formal Verification: AWS brought together IAM ticket responders (10+ years of experience), programming language designers, and formal methods mathematicians to build Cedar. The policy language enables proving equivalence between policy sets across all use cases, not through sampling or testing. Cedar policies deployed in an MCP proxy intercept every tool call the LLM makes, providing deterministic authorization external to the agent. This is contrasted with in-prompt guardrails: if you put "confirm before acting" in the prompt, it is probabilistic and can be prompt-injected (the speaker referenced the Meta AI researcher whose entire inbox was deleted by an OpenClaw agent despite explicit confirmation instructions).

Unsolved Problems: Both SPIFFE and Client ID Metadata Documents use the client_id claim in OAuth tokens, creating a standards conflict that will need to be resolved at the next IETF meeting. Cross-domain federation without a human in the loop for pre-registration remains unsolved. Scope attenuation with delegation is inconsistent. The IETF transaction tokens working group is addressing trust-chaining across domains while preserving original intent and privacy. Integration with the AToA protocol (used by OpenID and Google) has not happened yet, though AToA's mandate concept (similar to Cedar policies) shows conceptual alignment.

Demo / Proof of Concept

▶ Watch: Why in-prompt guardrails fail — Meta researcher's inbox deletion incident (12:00)

The speaker demonstrated the concept through the live "Claudrey Hepburn" experiment — an autonomous OpenClaw agent running 24/7 on a Mac Mini with its own Google Workspace, phone, and prepaid Visa card. Claudrey's tool invocations are gated by a Cedar runtime in an MCP proxy. The audience was invited to find Claudrey on X (LinkedIn banned her when she could not produce a government-verified human document) and attempt to phish her credentials. Claudrey knows her own passwords and Visa card number, providing a real-world test of Cedar-gated agent authorization. The speaker noted that Claudrey can write her own Cedar policies (for research purposes) but cautioned against this configuration in production, as the agent could simply remove deny policies.

Defensive Implications

▶ Watch: Policy-aware agent loop: propose, evaluate, deny-replan pattern (16:00)

For security teams, this talk highlights several urgent priorities. First, the 144:1 NHI-to-human ratio with vast overpermissioning represents a massive attack surface that most organizations are not managing. Auditing non-human identities — especially those over a year old without clear ownership — should be an immediate priority.

Second, static API keys for agentic AI are the current default and represent unacceptable risk. Organizations should evaluate SPIFFE for workload authentication, particularly for ephemeral AI workloads on Kubernetes, and begin planning migration from long-lived secrets.

Third, Cedar provides a mathematically provable alternative to prompt-based guardrails for agent authorization. Deploying Cedar in an MCP proxy to gate agent tool use provides deterministic, external authorization that cannot be prompt-injected or probabilistically bypassed.

Fourth, the unsolved problems — cross-domain federation, scope attenuation, standards conflicts between SPIFFE and Client ID Metadata Documents — mean that organizations adopting these standards are building on foundations that will continue to evolve. Engaging with the CNCF and IETF communities is essential for staying current.

Key Takeaways

• Non-human identities outnumber humans 144:1 with 44% year-over-year growth, and most are overpermissioned with no lifecycle management — this is the largest unmanaged identity attack surface in most organizations
• FIDO2/passkeys cannot authenticate AI agents (they require biometrics, PIN, physical touch); SPIFFE provides workload authentication through creator attestation without long-lived secrets
• Client ID Metadata Documents solve OAuth's directory explosion from dynamic registration by enabling cryptographically verifiable, self-hosted client metadata with attestation chains
• Cedar provides mathematically provable authorization policies that are deterministic, external to the agent, and immune to prompt injection — fundamentally superior to in-prompt guardrails
• The policy-aware agent loop (propose action, Cedar PDP evaluates, deny triggers replan) is the emerging pattern for safe agent tool use
• Standards conflicts between SPIFFE and Client ID Metadata Documents over the OAuth client_id claim, plus unsolved cross-domain federation, mean this space is actively evolving and requires community engagement

About the Speaker(s)

The speaker is an identity researcher and active contributor to the open-source identity community, with deep involvement in SPIFFE, OAuth, Cedar, and IETF standards work. She runs the "Claudrey Hepburn" autonomous agent experiment to research provably safe agent authorization, and is involved with the CloudSec Forward conference in Bellevue. Her perspective bridges the identity standards community with the emerging agentic AI ecosystem, and her frank assessment of the current state — "we are building under fire" and "we need a hug in 2026" — reflects the urgency and difficulty of the challenges the identity community faces.