Identity and Access Management in the Age of AI

Machine identities now outnumber human ones by roughly 40 to 1 in the modern enterprise — and a growing share of them can act autonomously, at machine speed, with no human in the loop. The Replit incident (July 2025) and the PocketOS incident (April 2026) weren't AI failures. They were identity failures that an AI agent happened to trigger. Identity and Access Management in the Age of AI is the field guide for closing that gap. Built as a vendor-neutral, hands-on playbook — not just a governance framework — this book walks practitioners through the full identity lifecycle for human, machine, and AI-agent identities: discovery and inventory, continuous access governance, platform-native configuration on Microsoft Entra ID, AWS IAM, and Okta, and a complete incident lifecycle from detection through post-mortem. Three documented identity incidents, worked in full, show exactly where standing access, ungoverned service accounts, and unconstrained agent privilege turn into blast radius. You will learn to: Build a non-human identity inventory that actually captures AI agent attributes — autonomy level, authorized APIs, human-in-the-loop mechanism — not just service-account metadata Replace periodic access reviews with continuous, real-time access certification for identities that are created and rotated at machine speed Configure Microsoft Entra ID, AWS IAM, and Okta for non-human and agentic identity governance, with platform-specific playbooks side by side Apply a seven-level containment ladder to contain an AI agent identity in progress, and write a defensible post-mortem that satisfies regulatory scrutiny Align to the standards you'll be measured against: NIST SP 800-61r3 and SP 800-207, the EU AI Act's identity-relevant obligations, ISO/IEC 27001, SOC 2, and the OWASP Top 10 for LLM Applications Whether you're an identity architect, security engineer, platform lead, or the person who gets paged when an agent's credential does something nobody authorized, this is the operational playbook for governing identity as the control plane of AI security — not an afterthought to it. Practical. Vendor-neutral. Built for the identity team that has to answer for what the AI agents actually did.