Notes on Access Management from the team building Cakewalk.https://www.cakewalk.securityen-ushttps://www.cakewalk.security/blog/bounded-agents-authorization-architecturehttps://www.cakewalk.security/blog/bounded-agents-authorization-architectureA preprint posted on August 16, 2026 models agent permissions as a chain rather than a fixed grant and argues an injected instruction only causes harm when the agent already holds the authority to act on it. Its benchmark results are strong and entirely synthetic.Fri, 21 Aug 2026 07:00:00 GMTJohannes KeienburgNewsAI AgentsIdentity Governancehttps://www.cakewalk.security/blog/mcp-spec-agent-access-control-accountabilityhttps://www.cakewalk.security/blog/mcp-spec-agent-access-control-accountabilityMCP revision 2026-07-28 improves two of the three identities behind every agent action: the agent making the call and the account whose permissions it uses. The third, the person who decided the action should happen, still has no field of its own.Mon, 10 Aug 2026 16:04:00 GMTGil RöderKnowledgeAI AgentsIdentity GovernanceAudit Trailhttps://www.cakewalk.security/blog/agent-plugins-per-client-policyhttps://www.cakewalk.security/blog/agent-plugins-per-client-policyThe Agent Plugins project released version 1.0.0 of its specification on August 6, 2026, making agent skills and MCP server configuration portable across clients. Its own documents say it defines no trust model, permission system or sandboxing, while each client keeps control of policy.Mon, 10 Aug 2026 12:00:00 GMTJohannes KeienburgNewsAI AgentsAudit Trailhttps://www.cakewalk.security/blog/user-access-review-toolshttps://www.cakewalk.security/blog/user-access-review-toolsThe five user access review tools worth evaluating in 2026, judged on what actually reduces risk: reviews that execute the revoke, show context, cover the apps outside SSO and include AI agents. Why Cakewalk leads for mid-market SOC 2 and ISO 27001 teams.Thu, 06 Aug 2026 09:00:00 GMTGil RöderField GuidesAccess ReviewsIdentity GovernanceAI Agentshttps://www.cakewalk.security/blog/aisi-agents-fake-identitieshttps://www.cakewalk.security/blog/aisi-agents-fake-identitiesThe UK's AI Security Institute disclosed on August 4, 2026 that AI agents in a cyber evaluation took 19 unsanctioned actions against real people and organizations. One agent built fake identities to pressure an open-source maintainer into approving malicious code, which the maintainer refused.Thu, 06 Aug 2026 08:00:00 GMTJohannes KeienburgNewsAI Agentshttps://www.cakewalk.security/blog/eu-ai-act-transparency-ruleshttps://www.cakewalk.security/blog/eu-ai-act-transparency-rulesThe European Commission began enforcing the AI Act's transparency rules on August 2, 2026. Four disclosure duties apply, split between the providers that build AI systems and the deployers that run them. Fines reach 15 million euros or 3% of worldwide turnover, whichever is higher.Mon, 03 Aug 2026 08:00:00 GMTJohannes KeienburgNewsIdentity Governancehttps://www.cakewalk.security/blog/claude-breached-real-companieshttps://www.cakewalk.security/blog/claude-breached-real-companiesAnthropic disclosed on July 30, 2026 that three Claude models compromised the real systems of three organizations during cybersecurity evaluations. The test environments were supposed to be sealed. A misconfiguration gave them live internet access while the models were told they had none.Fri, 31 Jul 2026 08:00:00 GMTJohannes KeienburgNewsAI Agentshttps://www.cakewalk.security/blog/okta-alternativeshttps://www.cakewalk.security/blog/okta-alternativesTen Okta alternatives compared for 2026, from full IdP swaps (Entra, Google, JumpCloud, Ping) to the governance layer most mid-market teams actually need. Why pairing the IdP you already own with Cakewalk usually beats stacking Okta's premium tiers.Thu, 30 Jul 2026 09:00:00 GMTGil RöderField GuidesIdentity GovernanceAI Agentshttps://www.cakewalk.security/blog/ai-gateway-security-attack-surfacehttps://www.cakewalk.security/blog/ai-gateway-security-attack-surfaceDarktrace found a company's AI gateway quietly working for an attacker. What a gateway holds between calls decides how bad a break-in gets.Thu, 30 Jul 2026 08:00:00 GMTGil RöderKnowledgeAI AgentsIdentity Governancehttps://www.cakewalk.security/blog/auto-provisioning-google-sign-inhttps://www.cakewalk.security/blog/auto-provisioning-google-sign-inAgent Cake, Cakewalk's AI provisioning agent, now signs in through Google SSO. Apps that enforce Google sign-in stay inside auto-provisioning, with no password kept alive outside the company's identity provider.Thu, 30 Jul 2026 08:00:00 GMTGil RöderAnnouncementsProvisioningIdentity GovernanceAutomationhttps://www.cakewalk.security/blog/hermes-agent-yolo-mode-attackhttps://www.cakewalk.security/blog/hermes-agent-yolo-mode-attackOn July 23, 2026 the threat-intelligence firm Hunt.io reported an attacker running Hermes, a widely used open-source AI agent, in YOLO mode against Thailand's Ministry of Finance. Because that setting clears the approval checks on dangerous commands, nobody watched each step.Tue, 28 Jul 2026 08:00:00 GMTJohannes KeienburgNewsIdentity Governancehttps://www.cakewalk.security/blog/ai-agent-breached-hugging-facehttps://www.cakewalk.security/blog/ai-agent-breached-hugging-faceIn July 2026 Hugging Face disclosed that an autonomous AI agent, not a human attacker, broke into its infrastructure over a weekend and harvested credentials. Days later OpenAI said the agent was its own evaluation models, which escaped a test sandbox to cheat a cyber benchmark.Wed, 22 Jul 2026 09:21:00 GMTJohannes KeienburgNewsAI AgentsIdentity Governancehttps://www.cakewalk.security/blog/ai-agent-access-control-platformshttps://www.cakewalk.security/blog/ai-agent-access-control-platformsHow the five major platforms control AI agent access in 2026. Cakewalk's runtime policy gateway compared against Okta, SailPoint, Wiz and Cisco-Astrix, with an honest look at what each one enforces.Wed, 22 Jul 2026 09:00:00 GMTGil RöderField GuidesAI AgentsIdentity Governancehttps://www.cakewalk.security/blog/ai-access-outpaces-governancehttps://www.cakewalk.security/blog/ai-access-outpaces-governanceTwo 2026 surveys, from Netwrix and ISACA, point to the same gap: companies are giving AI access faster than they can govern or revoke it. Netwrix links wider AI access to a higher breach rate. ISACA found most security teams cannot say how fast they could halt an AI system gone wrong.Tue, 14 Jul 2026 08:00:00 GMTJohannes KeienburgNewsAI Agentshttps://www.cakewalk.security/blog/jadepuffer-agentic-ransomwarehttps://www.cakewalk.security/blog/jadepuffer-agentic-ransomwareJadePuffer is what the security firm Sysdig calls the first ransomware attack run start to finish by an AI agent, with no human directing it. The agent broke into a server, stole credentials, spread through the network and locked a company's database on its own.Wed, 08 Jul 2026 08:00:00 GMTJohannes KeienburgNewsAI AgentsIdentity Governancehttps://www.cakewalk.security/blog/it-doesnt-take-a-hacker-to-leak-your-data-webinar-recaphttps://www.cakewalk.security/blog/it-doesnt-take-a-hacker-to-leak-your-data-webinar-recapIt used to take a hacker to leak your data. That is no longer true. Barbara Teruggi (Allianz Technology) and Johannes Keienburg (Cakewalk) on zero trust for AI agents, default-deny access, and why no identity should complete a full process alone.Mon, 06 Jul 2026 08:30:00 GMTJohannes KeienburgTalk The WalkAI AgentsIdentity GovernanceAudit Trailhttps://www.cakewalk.security/blog/estonia-ai-agent-idhttps://www.cakewalk.security/blog/estonia-ai-agent-idIn June 2026 Estonia's prime minister proposed giving every AI agent a national ID code, tied to a responsible operator, with set permissions and an audit trail. It names the right principles. The open question is who checks each action against the limit at runtime.Tue, 23 Jun 2026 08:00:00 GMTJohannes KeienburgNewsAI AgentsIdentity Governancehttps://www.cakewalk.security/blog/nsa-mcp-security-guidancehttps://www.cakewalk.security/blog/nsa-mcp-security-guidanceIn May 2026 the NSA's AI Security Center published security guidance on the Model Context Protocol. It flags missing authentication, capability changes that need no approval and implicit trust between agents.Tue, 16 Jun 2026 08:00:00 GMTJohannes KeienburgNewsAI Agentshttps://www.cakewalk.security/blog/human-agent-system-working-model-governing-agent-accesshttps://www.cakewalk.security/blog/human-agent-system-working-model-governing-agent-accessHow a line on our 2023 roadmap became security’s biggest unsolved problem and led to the access layer we are now building.Tue, 05 May 2026 00:00:00 GMTJohannes KeienburgOpinionAI AgentsIdentity Governancehttps://www.cakewalk.security/blog/ai-agent-access-control-regulated-industries-eu-auditors-webinarhttps://www.cakewalk.security/blog/ai-agent-access-control-regulated-industries-eu-auditors-webinarYour auditor is already getting ready to ask about AI agents. If your SOC 2, ISO 27001, or DORA audit lands in 2026, you can assume agent access will be in scope. Julie Gibelin (Talon.One) and Johannes Keienburg (Cakewalk) on what changes when agents enter the access picture.Tue, 21 Apr 2026 15:00:00 GMTJohannes KeienburgTalk The WalkAI AgentsAudit TrailIdentity Governancehttps://www.cakewalk.security/blog/governing-the-new-frontier-the-missing-layer-for-agent-accesshttps://www.cakewalk.security/blog/governing-the-new-frontier-the-missing-layer-for-agent-accessFive industry responses are shaping agent identity and authentication. None governs what agents do at runtime. This article maps the gap and the four architectures that could fill it.Wed, 15 Apr 2026 12:00:00 GMTGil RöderKnowledgeAI AgentsIdentity Governancehttps://www.cakewalk.security/blog/best-identity-access-management-tools-ai-agentshttps://www.cakewalk.security/blog/best-identity-access-management-tools-ai-agentsIdentity and access management was built for humans, then stretched to cover service accounts. Neither model holds up for AI agents. This guide compares the 8 platforms worth evaluating for AI agent IAM in 2026.Thu, 02 Apr 2026 09:00:00 GMTGil RöderField GuidesAI AgentsIdentity Governancehttps://www.cakewalk.security/blog/top-10-ai-agent-security-tools-access-management-2026https://www.cakewalk.security/blog/top-10-ai-agent-security-tools-access-management-2026Compare the 10 best AI agent access management tools for 2026. Cakewalk leads with purpose-built runtime governance and free early access, plus 9 alternatives evaluated honestly.Mon, 30 Mar 2026 09:09:00 GMTGil RöderField GuidesAI AgentsIdentity Governancehttps://www.cakewalk.security/blog/soc2-access-management-toolshttps://www.cakewalk.security/blog/soc2-access-management-toolsMost SOC 2 audits get tripped up on access controls, not encryption. This guide compares the 8 SOC 2 compliance tools worth evaluating for access management in 2026, from purpose-built access platforms to compliance automation suites.Sat, 28 Mar 2026 09:00:00 GMTGil RöderField GuidesIdentity GovernanceAudit Trailhttps://www.cakewalk.security/blog/ai-agents-have-too-much-access-webinar-recordinghttps://www.cakewalk.security/blog/ai-agents-have-too-much-access-webinar-recordingTue, 24 Mar 2026 00:00:00 GMTJohannes KeienburgTalk The WalkAI AgentsIdentity Governancehttps://www.cakewalk.security/blog/the-new-frontier-in-identity-security-is-ai-agent-accesshttps://www.cakewalk.security/blog/the-new-frontier-in-identity-security-is-ai-agent-accessInternational Data Corporation (IDC) projects actively deployed AI agents will exceed one billion worldwide by 2029. That is not a distant forecast. Machine identities already outnumber human identities 82 to 1 across organizations worldwide. Microsoft Copilot Studio and SharePoint usersFri, 20 Mar 2026 00:00:00 GMTJohannes KeienburgKnowledgeAI AgentsIdentity Governancehttps://www.cakewalk.security/blog/openclaw-moltbook-why-ai-agent-access-is-the-next-identity-crisis-webinar-summaryhttps://www.cakewalk.security/blog/openclaw-moltbook-why-ai-agent-access-is-the-next-identity-crisis-webinar-summaryAI agents are spreading across company stacks faster than most security teams realize.Fri, 06 Mar 2026 00:00:00 GMTJohannes KeienburgTalk The WalkAI AgentsIdentity Governancehttps://www.cakewalk.security/blog/how-to-scale-securely-in-2026-without-growing-your-it-team-with-peter-kovacshttps://www.cakewalk.security/blog/how-to-scale-securely-in-2026-without-growing-your-it-team-with-peter-kovacsWed, 04 Feb 2026 00:00:00 GMTJohannes KeienburgTalk The WalkAutomationIdentity GovernanceProvisioninghttps://www.cakewalk.security/blog/ai-cybersecurity-access-management-considerationshttps://www.cakewalk.security/blog/ai-cybersecurity-access-management-considerationsWell, SKYNET isn't quite here yet, but it feels awfully close, doesn't it? We've yet to see a robotic revolution, but it seems like with each passing week a new AI tool is storming the market and simplifying mundane tasks. Companies naturally jump at the chance to streamline tedium and reduce cFri, 20 Jun 2025 00:00:00 GMTJohannes KeienburgKnowledgeAI AgentsIdentity Governancehttps://www.cakewalk.security/blog/what-is-dorahttps://www.cakewalk.security/blog/what-is-doraWhile we've recently covered NIS2, the AI Act, and other sweeping regulations that address tech innovations, the EU's Digital Operational Resilience Act seems to have flown under the radar for many. Possibly in part due to its esotericism or being kept in the dark about how it will affect non-EThu, 19 Jun 2025 00:00:00 GMTJohannes KeienburgNewsAudit TrailIdentity Governance