{"resourceId":"vanderbilt-ai-agent-identity-governance-20260925","versions":[{"version":"external-1d96954dd356cdeb606a8e60315019c15a64f8d0f58d7b83bb2ae93f615761b9","resource":{"id":"vanderbilt-ai-agent-identity-governance-20260925","title":"Vanderbilt extends identity governance to AI agents amid unresolved liability questions","organization":"SiliconANGLE","sector":"Higher education identity, cybersecurity, and IT governance","geography":"United States (Vanderbilt University)","publishedAt":"September 25, 2026","publicationDate":"2026-09-25","eventDate":"2026-09-25","sourceName":"SiliconANGLE / theCUBE","sourceLabel":"Independent technology reporting (paid media partner disclosure for Okta Oktane)","sourceUrl":"https://siliconangle.com/2026/09/25/vanderbilt-university-extends-identity-governance-ai-agents-oktane/","evidenceClass":"independent-reporting","outcomeClass":"emerging","topics":["data-security","developers-agents","governance-procurement","operating-model"],"finding":"Vanderbilt CIO Shane Callahan describes extending OneVU (Okta-powered) identity governance to AI agents, arguing agents need distinct, scoped identities within existing technology-intake and cross-functional governance rather than a parallel framework. He highlights unresolved accountability when agents exceed guardrails—including whether cyber insurance responds—and notes universities’ multi-affiliation identity complexity (student/staff/donor profiles). Coverage carries an explicit Okta Oktane paid-media-partner disclosure.","sledRelevance":"Practical campus-operations guidance for securing agentic AI: reuse IAM intake processes, issue scoped agent identities, and escalate liability/insurance gaps to risk leadership before broad agent deployment across residential life, research, and campus services.","evidence":"Interview statements from Vanderbilt CIO at Oktane via theCUBE; no quantitative outcome metrics; disclosure that theCUBE is a paid media partner for the Okta event and sponsors lack editorial control over SiliconANGLE content.","architectureImplications":"Treat agents as first-class identities in SSO/IGA: unique credentials, least privilege, lifecycle join/move/leave, and intake review equivalent to other enterprise apps.","governanceImplications":"Reuse existing technology governance instead of inventing AI-only bureaucracy; still escalate unresolved liability allocation between institution and tool vendor to board-level risk appetite.","securityPrivacyImplications":"Scoped agent identities limit blast radius, but accountability and insurance coverage for out-of-guardrail actions remain unclear—material for security and risk committees.","caveats":"Event-floor interview without deployment metrics; Okta sponsorship context; liability/insurance answers remain open questions rather than solved controls.","streamIds":["campus-operations"],"roles":{"sales":"For CISOs and CIOs enabling campus agents, lead with identity governance reuse rather than a brand-new AI security suite. Ask whether agents already have distinct identities, how technology intake reviews apply, and whether risk and insurance teams have opined on out-of-guardrail liability. A bounded engagement is an agent-identity readiness review against existing IGA controls, not a claim that any single IdP vendor resolves accountability on its own.","engineering":"Extend IGA to non-human identities: provision scoped agent accounts, map entitlements to workflows, and integrate with technology intake the same way other enterprise apps are reviewed. Prerequisites include an authoritative identity fabric and a living application inventory. Constraints include multi-affiliation campus roles and unclear liability allocation. Proof of value is coverage of production agents under the same joiner-mover-leaver controls used for staff applications.","delivery":"Inventory agentic workloads, assign accountable owners, enroll each agent in intake and IGA, and table liability and insurance questions with risk management before scaling across units. Ownership rests with CIO and CISO, with the risk office on insurance interpretation. Acceptance requires every production agent to have a unique identity, owner, and entitlements review. The key risk is parallel shadow agent identities that bypass IAM entirely."},"roleDetails":{"sales":{"customerProblem":"AI agents are entering campus workflows without clear non-human identity, ownership, or liability allocation when they exceed guardrails.","stakeholders":["CIO","CISO","IAM architect","risk/insurance","application owners in student life and research"],"discoveryQuestions":["Do production AI agents have unique identities in the IdP/IGA?","Is technology intake mandatory for agentic tools?","Has cyber insurance been reviewed for autonomous agent actions?","Who is the operational owner when an agent impacts another unit?"],"valueHypothesis":"Reusing IAM and intake for agents can reduce orphaned privileges and clarify ownership faster than inventing a separate AI governance stack—without resolving insurance liability alone.","potentialEngagement":"Two-week agent identity readiness assessment: inventory, identity gaps, intake mapping, and risk questions for insurance counsel.","unsupportedClaims":["That identity tooling assigns legal liability between campus and vendor","That Okta/OneVU specifically is required","Measured breach reduction from this interview"]},"engineering":{"fit":"Strong fit for campuses with mature SSO/IGA preparing to run agents across mixed student, staff, research, and public-safety systems.","architectureIntegration":"Register agents as non-human identities; issue scoped tokens; apply joiner-mover-leaver; bind each agent to an accountable human owner and audited entitlements.","prerequisites":["Enterprise IdP/IGA in production","Technology intake workflow","Agent inventory including shadow tools"],"constraints":["Multi-affiliation identity complexity","Vendor agents that cannot accept campus-scoped identities","Unresolved insurance/liability allocation"],"security":"Least-privilege agent credentials, continuous access review, and monitoring for out-of-guardrail actions with human escalation.","proofOfValue":["Percent of production agents enrolled in IGA","Entitlement review completion rate","Time-to-revoke for decommissioned agents"]},"delivery":{"work":"Build agent inventory, enroll identities, assign owners, update intake checklists, and convene risk/insurance on liability scenarios.","dependencies":["IAM platform capacity","risk/insurance advisors","application owner participation"],"ownership":"CISO/IAM owns identity controls; CIO owns intake policy; risk management owns insurance interpretation.","skillsAdoption":"Train app owners to request agent identities like service accounts and to avoid shared human credentials for bots.","governanceCheckpoints":["Intake approval before production agent launch","Quarterly access review for non-human identities","Risk committee briefing on liability gaps"],"acceptanceCriteria":["No production agent using shared human credentials","Each agent has owner, purpose, and entitlement record","Documented open questions to insurance counsel"],"risks":["Event-interview guidance overstates maturity","Shadow agents outside IAM","Liability ambiguity delays or falsely reassures leadership"]}},"retrievedAt":"2026-09-26T21:57:10-05:00","enrichedAt":"2026-09-26T22:03:32-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Clear agent ownership and human accountability pathways reduce ambiguous workload when automation fails; multi-role campus identities remain a usability and security challenge for staff who hold several affiliations.","procurementImplications":"Require vendors to support distinct agent identities, entitlement export, and contractual allocation of responsibility for out-of-guardrail actions; escalate cyber-insurance compatibility in vendor risk review.","operatingModelImplications":"Fold AI agents into existing technology intake and IAM operating model rather than a parallel AI PMO; escalate unresolved liability to institutional risk appetite discussions.","sourceVerification":{"openedUrl":"https://siliconangle.com/2026/09/25/vanderbilt-university-extends-identity-governance-ai-agents-oktane/","referenceExcerpt":"If you have a governance process and a technology intake program, do that, use that.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}