Agentic AI Identity Security
摘要
This chapter addresses the critical identity and access management (IAM) crisis introduced by dynamic, autonomous Agentic AI systems. It argues that traditional, human-centric IAM frameworks like OAuth and SAML are fundamentally inadequate, citing their reliance on static, coarse-grained permissions and interactive flows. As a solution, a modern, identity-centric security model grounded in Zero Trust principles is proposed. The chapter details a practical architecture beginning with authentication, using SPIFFE/SPIRE to bootstrap strong, short-lived, and auto-rotated workload identities via platform attestation, thereby eliminating static secrets. This foundation is then extended to solve authorization by decoupling policy enforcement from decision-making, using a Policy Decision Point (PDP) like Open Policy Agent (OPA) to enable fine-grained, Attribute-Based Access Control (ABAC). The full identity lifecycle—from automated provisioning and dynamic runtime adaptation with Just-in-Time (JIT) access to robust, layered revocation strategies—is also covered. By integrating these components, the chapter provides a roadmap for engineers to build a resilient and secure identity foundation for Agentic AI.