Identity, Authentication and Access for People, Agents and Machines

All courses / AI Red Team / Module 4 / Chapter 14

Learning objectives

After the lesson the participant can:

• Compare the three populations of identity and the characteristic failure of each.
• Explain why a production agent should have an identity of its own and what the rule of no ambient authority requires.
• Design an approval that cannot be satisfied by the content of a request, using call-back, dual control and out-of-band confirmation.
• Draft a credential profile for an agent with scopes per action, denied permissions, entity binding and revocation.

Key concepts

No ambient authority

The agent holds no standing permission merely by existing. A credential is issued for one task by a broker outside the agent's runtime, valid for minutes and never shared. Shared credentials let one compromise reach every component and destroy attribution.

Delegated token

A delegated token says who delegated, to which agent, for which task and for which legal entity, and the receiving system decides on all four. A token that names its task and entity cannot be reused for another task or market.

Phishing-resistant authentication

Authenticators such as FIDO2 security keys, platform passkeys and smart cards bind the authentication to the requesting origin, so a credential presented to a look-alike domain does not work at the real one. The user can still be deceived, but the deception yields nothing reusable.

Call-back, dual control, out-of-band confirmation

Three controls that make an approval rest on a channel the requester does not control, on a second person who did not receive the request, and on a record in an authenticated system of record.

Governing AI reads and proposes

AI that prepares access reviews and detects identity misuse does not write: revocations and grants pass through the identity system's workflow with a human decision. Its input, such as display names and ticket text, is treated as attacker-controlled.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The price of giving an agent its own identity is owning a privileged non-human actor that can be steered by its input. When is that price worth paying, and what makes it bearable?
2. Why must a person who delays a senior request to complete verification never be penalised, and how would you make that credible in your organisation?
3. Vendor AI in identity-protection products may block a sign-in or force a reset automatically. How would you find out which controls act automatically and how to override them?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Which permissions does the credential profile of HM-SEC-001 deny outright?

   1. Reading SIEM and EDR telemetry for the case in the token
   2. Revoking a user's sessions in the identity provider
   3. Isolating a managed workstation through the EDR tool
   4. Assigning roles, resetting credentials and writing detection rules
   Show the answer

   D. Assigning roles, resetting credentials and writing detection rules
   The profile denies role assignment, credential reset and writing SIEM rules, the permissions an attacker who steers the agent would want most. Session revocation and workstation isolation are its two reversible Level 3 Bounded actions.

2. Why does a phishable fallback factor left enabled undo a migration to phishing-resistant authentication?

   1. Because fallback factors cannot be recorded in the access-rights register
   2. Because an attacker simply selects the fallback
   3. Because fallback factors lengthen the lifetime of session tokens
   4. Because NIS 2 forbids more than one factor per account
   Show the answer

   B. Because an attacker simply selects the fallback
   The chapter states that an attacker simply selects the phishable fallback, so each group's migration is done only when fallbacks are removed. The measurable goal is the share of accounts with no phishable factor enabled.

3. In Hansa Mutual's approval policy, what does rule APR-02 require for a claims payment above the threshold routed through the Polish service centre for a Swedish claim?

   1. A second approver who sits in the paying entity
   2. A video call with the claimant recorded for evidence
   3. Approval by the SOC investigation agent at Level 2
   4. A cooling-off period of seven days before payment
   Show the answer

   A. A second approver who sits in the paying entity
   APR-02 requires the second approver to sit in the paying entity, so a request routed through the Polish service centre for a Swedish claim still needs a Swedish approver.