Show notes
What happens when an autonomous AI agent can complete thousands of actions before a traditional access review has even identified that something has gone wrong? In this episode of Tech Talks Daily, I speak with Alex Bovee, CEO and co-founder of C1, about identity security, runtime governance, shadow AI, and the controls companies need as humans and agents begin working together. Alex has spent much of his career in identity and security. He and his co-founder previously worked at Okta on zero trust products before creating C1 as an access control platform capable of operating at machine speed. That requirement has become increasingly important as AI agents begin accessing company data, calling tools, using credentials, and taking actions across enterprise systems. Alex describes agents as non-deterministic systems that can "reward-max." An agent may pursue its assigned objective so aggressively that it finds an unexpected or dangerous way to complete the task. It does not possess a moral compass or an intuitive understanding of what the company considers acceptable. Traditional identity processes were created for people. A company might review access every 90 days or investigate a security issue after an event. That approach becomes inadequate when an agent can execute thousands of actions within minutes. We discuss why identity is becoming a control plane for AI agents. Networks, data systems, and security tools all play important roles, but identity determines which resources an agent can access, which actions it can perform, and whether it acts independently or on behalf of a person. Without a defined identity or delegated authorization model, an organization may struggle to connect an agent's behavior with a responsible owner, a limited mission, and enforceable permissions. Alex explains the four connected capabilities inside C1's Agentic Control Plane. The first concerns shadow AI discovery. Companies need visibility across cloud services, SaaS applications, endpoint agents, hosted agents, local MCP servers, and credentials stored throughout the environment. This is particularly relevant because employees are downloading locally developed or "vibe-coded" MCP servers and running agent tools on their devices. These components can introduce software supply chain risks and expose local credentials. The second capability covers credential security. C1 has introduced a post-quantum credential vault designed to protect secrets and inject them into authorized agent workflows without leaving credentials scattered across devices and applications. The third area is runtime governance. Instead of reviewing behavior after an incident, organizations can evaluate an agent's actions against its assigned mission as they occur. If an agent is authorized to complete one business task but begins exploiting an internal tool, contacting an unapproved service, or attempting to extract data, runtime controls can block the action or request human approval. The fourth capability concerns agentic security intelligence. This uses information collected across identities, agents, permissions, credentials, and behavior to identify risks and support automated remediation. We also discuss human accountability. Alex says emerging regulatory thinking recognizes the need for a responsible person behind an autonomous agent. That connection allows businesses to establish ownership, delegate authority, and determine who remains accountable for the agent's behavior. The conversation then turns to the effect of AI on employees. Alex rejects the assumption that organizations will simply remove people as agents become more capable. His preferred analogy is that people are moving from manually producing every artifact to building and supervising the factory. Employees provide the inputs, direct the agents, examine the outputs, and correct the process when necessary. C1 has experienced this internally. Alex says its engineering team increased from roughly 150 weekly software merges to around 1,500, while engineering headcount grew by approximately 10% to 15%. That productivity requires careful human review. Generating work faster does not remove the need to assess whether the output is accurate, secure, useful, and aligned with the original objective. For CISOs and CIOs, the goal is to provide a governed path for AI adoption. A blanket prohibition may encourage employees to work around policy. Secure self-service access can give teams approved tools, defined permissions, and runtime protection. If an AI agent can operate at machine speed, are your organization's identity controls capable of observing, authorizing, and stopping it at the same pace? Listen to the conversation and share your thoughts with me.