Securing Astra CMS for Humans and AI Agents: An Identity-First Approach to IAM
"Hackers don't break in, they log in." That one line from a recent identity-security briefing explains why a CMS that is about to host AI agents needs an identity plan before it needs anything else. T
Responses
Markdown supported · ⌘↵ to post
Really appreciated how you framed the three gaps — accountability is the one I keep coming back to. The on-behalf-of token pattern, with the delegating user named in the token, is the cleanest answer I have seen to the forensics problem: without that link, an agent's actions are just unattributed API calls. The maturity ladder resonated too — "connect what you have, don't replace it" is the right sequencing, since most teams already have Keycloak or something similar in place, and the bigger lift is registering agents and removing standing privilege. One question: in the Level 3 setup, how are you thinking about revocation when a delegation is withdrawn mid-task — does the short TTL carry that on its own, or is there an explicit check on each call?