Why AI agents need employee‑like IDs and NewCore’s $66M solution
Why AI agents need employee‑like IDs and NewCore’s $66M solution
Photo by ThisIsEngineering on Pexels
When AI agents start showing up on payrolls
The line between tool and worker gets blurry. In many cases, when a customer-service chatbot is handling hundreds of tickets daily, things change. That said, companies are now treating these chatbots like employees, filling out HR forms and whatnot. They used to just log the bot's API key. Still, now they're dealing with all sorts of paperwork.
The shift isn't just paperwork. The thing is, rewiring the entire risk matrix is a complex process. And yet, a rogue prompt can exfiltrate data like a disgruntled employee, but traditional perimeter tools miss non-human users. No human in sight. Auditors want to know "who did what," but now the answer lies in logs of model version numbers, not badge numbers. The thing is, this changes everything. To be fair, startups already allocate budget to AI assistants, essentially giving them a salary. They even show up on org charts. Which means, security teams must adapt, asking new questions about authentication and least-privilege. Code that rewrites itself demands new lifecycle management strategies. What does that mean for security?
Practical headaches emerge quickly. Engineering leads often create LLM instances for proof-of-concepts. They forget to shut them down. This mistake can be costly. That said, a fintech company learned this the hard way when a research bot continued to access. Sensitive transaction data months after a project ended, all because of an un-revoked token. The industry is shifting its focus. From prioritizing human protection to safeguarding autonomous actors, a new approach is taking hold. Mistakes like these drive change. The goal now is to protect the autonomous actor.
Static service accounts are the norm. Still, most enterprises stick with them, a relic from micro-services' early days. They work fine for predictable workloads. But when an agent is upgraded or forked, things fall apart. At the same time, handoffs to different teams are a problem too. Interestingly, the outcome: a mess of shadow identities that can't be audited. Nobody knows what's going on.
NewCore’s $66 million answer to the identity problem
NewCore's premise is simple: every AI agent needs a cryptographic passport. Verification is key. The organization can verify this passport, which is crucial. NewCore secured funding through a Series A round, led by venture and corporate investors, giving them the resources to develop. A cloud-native directory that integrates with existing identity providers, speaking their language to facilitate verification and authentication. That's a big deal.
The platform's differentiation lies in binding an agent's model fingerprint to a human-readable identity record. Honestly, short and sweet: this is key. When a new model is uploaded, a complex process unfolds: NewCore computes a hash, stores it in a tamper-evident ledger, and issues a short-lived credential. Which means, this credential is more than just a token - it carries metadata about the model's owner, allowed scopes, and expiration policy. Security teams can enforce specific policies, like only allowing version 2. The thing is, 1 of the sales-forecast model to write to the revenue database.SAML and OIDC integration is. Also supported, which means bot identities show up alongside user accounts in existing IAM dashboards. Done right, this design can be incredibly effective.
Zero-trust principles are at the platform's core. Every request is suspect. The policy engine evaluates each call, considering the model's history, request context, and recent behavior. Behavioral anomalies trigger alerts. If a chatbot starts snooping around HR records, the engine quarantines the credential instantly. This proactive approach helps prevent data breaches.
NewCore can stream identity events into your existing SIEM. This simplifies security. A unified view emerges.Security analysts can now answer specific questions, like which agent accessed the customer database at 02:13 UTC. Honestly, they get actionable security data.
Frequently Asked Questions
How does NewCore secure AI agents in practice
Here's the rewritten text: Short-lived credentials get issued. They're cryptographically signed and tied to each model's unique hash. This setup allows policies to dictate which resources are accessible - and if there's any deviation, the credential is automatically revoked. Simple.
Can existing identity providers manage AI bot identities
NewCore supports standard SAML and OIDC endpoints. This matters. Enterprises can add bot records to Azure AD or Okta with ease, no custom code required. Just add and you're done. Interestingly, azure AD, Okta, or any LDAP directory - the choice is yours. No coding expertise needed, a major plus.
💡 Expert Tip: Token-based identity drift is a real issue. Fine-tuning a model changes its hash. You must rotate its credential. If not, a stale identity lingers in logs, causing problems. This can lead to security vulnerabilities and errors in your system, so regular credential rotation is essential to prevent such issues.
Final Thoughts
Autonomous agents are taking over. They're doing work that once needed a human touch. The line between software and staff is fading fast. What's the impact on accountability? Bots will get IDs, no question. At the same time, but how will those IDs change the way we assign blame across the enterprise? Simple: they'll make it tougher to pinpoint responsibility. The real issue is accountability, not the IDs themselves.
Comments
Post a Comment