TL;DR: Most "AI + identity" conversations are about AI for IAM, using models to speed up identity work. On The Non-Human & AI Identity Podcast, C1.ai CEO Alex Bovee argued the priority runs the other way: IAM for AI is the bigger imperative, because agents are already acting as an ungoverned workforce.
- AI for IAM is an efficiency story. Useful, real, and not where the risk is.
- IAM for AI is an architecture story: "agents need a center of gravity with which you can control them," and "identity really is the linchpin of that."
- Agents already create other identities. Harnesses support sub-agents and the federation of work, which Bovee calls an inevitability that needs control points, not prohibition.
- The insider threat just got amplified. Humans came with a moral compass; agents don't, which is why behavior analytics is making a comeback.
- The order of operations matters: govern the AI first, then let AI accelerate the governing.
Every vendor in the identity space, C1.ai included, talks about what AI can do for identity programs: faster decisions, smarter recommendations, less toil. Put on the spot about whether IAM for AI matters more than AI for IAM, Bovee picked IAM for AI, and the reasoning is worth sitting with, because it cuts against how most organizations are sequencing their investments.
AI for IAM, in Bovee's description, is about automating what used to be manual, useful work that speeds up deployment and adoption. His case for the other direction is architectural: "The bigger architectural shift here is really around agents need a center of gravity with which you can control them, and they need various control points surrounding them. And I think that identity really is the linchpin of that." Not the endpoint, not the network, but the identity of the agents themselves, authenticated and authorized in real time. One of those is an efficiency story. The other governs a new workforce that's already on the payroll, and only one of them is optional.
AI agents are already creating other identities. Is that a problem?#
Here's the episode's most arresting exchange. Asked whether agents should be allowed to create and provision other identities, Bovee pointed out that the question is already moot: "I think they kind of already do. A lot of harnesses support subagents and the federation of work, and so I think that's an inevitability." Pressed on whether that's actually a good thing, his answer was notably unpanicked: "It's about parallel processing and multitasking for agents. I don't think it's intrinsically a bad idea. I just think you need the same control points."
That's the right frame, and it has a sharp implication for the existing toolchain, which Bovee drew out later in the conversation: "It's not going to be sufficient to depend on traditional technologies, say privileged access management technologies that are focused on check-in, check-out credentials, when agents can generate their own credentials." Prohibition would neuter the automation that makes agents valuable, and vaulting assumes the credentials all pass through the vault. The alternative is treating identity creation as a governed action like any other: an agent can spawn a sub-agent or mint a credential if policy allows it in that context, the new identity enters the inventory at birth with an owner and a TTL attached, and the full chain is recorded, which agent, on whose authority, created what, with which permissions.
Without those control points, you get recursion: ungoverned identities creating more ungoverned identities, each one expanding the surface we mapped in the discovery post.
Why is the insider threat suddenly back on the agenda?#
Because an agent is structurally an insider, a point the podcast's host has built a whole keynote around, the insider threat amplified. Bovee's version of the argument explains why the old insider threat market stayed niche and why that's about to reverse. Insider threat products never took off in a mass way, he noted, because "humans have a moral compass and they have a reason to not do things." Agents removed that free control, and he expects the detection layer to return because of it: "I think we'll see a resurgence of some of the types of technology that were used to detect things like insider threats in this new agentic world because of the untrustability of them," naming user and entity behavior analytics specifically as "super relevant in the agentic world."
There's a twist, though: behavioral baselines are harder when the entity is non-deterministic by design, which is why behavior monitoring can't stand alone. It has to pair with runtime controls that bound what any single compromised or confused agent can do: per-action authorization, task-scoped access, and credentials the agent never holds. Detection tells you something went wrong; the bounded blast radius is what keeps "wrong" survivable.
So is AI for IAM wrong?#
Not wrong, just second. There's a genuine flywheel here: identity programs drowning in NHI sprawl need AI-scale help, and AI-scale help is exactly what AI-native governance provides. But an AI that accelerates your identity program while your agents run ungoverned is optimizing the part of the problem that was already under control. Sequence it the other way. First, every agent gets an identity, an owner, and runtime boundaries. Then, with the new workforce governed, let AI make the whole program move at the speed that workforce demands.
How does C1.ai deliver IAM for AI?#
This is the thesis C1.ai is built on. Agents authenticate through agent SSO, act through governed gateways where every tool call is authorized individually, receive credentials vended at the moment of use, and leave an attributable record of everything they do, including the identities they create. The digital workforce is already here. IAM for AI is how it gets an HR department.
Hear Alex make the case on The Non-Human & AI Identity Podcast, then see C1.ai in action.
