[Information Security Solutions Conference] “AI Agents Also Need Separate Identity and Permission Management”

At the '2026 Information Security Solutions Conference' held on the 9th at L Tower in Yangjae-dong, Seoul, Kim Dong-hoon, head of the Consulting Division at Softcamp, gave a presentation on the topic of 'AI Security for Using Generative AI and AI Agent.' The event was reported by IT DAIL and the photo was taken by reporter Kim Byeong-ju.

Kim said that as the use of generative AI and AI agents spreads, security discussions need to shift from whether to allow AI to how to control it, the level of control, and the scope of permission.

He also emphasized a security framework for the era of AI agents.

As the scope of AI use expands from generative AI to AI agents, the security targets are changing as well. At the generative AI stage, the main task was to manage whether personal information and confidential information were being transferred to external services and to control the data, but AI agents take on direct work such as reading files, calling APIs, and modifying or deleting data. Kim explained that this means control is needed not only over data but also over the agents' actions.

Kim said AI agents have greater resource access and speed than humans. Unlike users who access files on a file-by-file basis, AI agents can access folders and drives, and they can read hundreds of files or several thousand files at the same time. He also said that once a token or secret key is issued, they can automatically access connected system resources, and that multiple agents can be duplicated for parallel work, describing AI agents as a new class of privileged users.

It has been pointed out that existing security frameworks do not sufficiently reflect the characteristics of AI agents, and that the existing account and IAM designs are based on human hiring and departure as well as account issuance and revocation, which limits their ability to respond to AI agents. AI agents operate 24 hours a day and can access large amounts of data in a short time, but anomaly detection based on security information and SIEM can be retrospective, meaning work may be completed before detection occurs. It was also noted that existing accounts and IAM have limitations in managing AI agent identities and actions. Kim said that because AI agents have the nature of privileged users, they need the same lifecycle management as people.

In response, Softcamp proposed a way to assign NHI (Non-Human Identity) to AI agents. The approach manages owners, purposes, and permissions together by assigning an owner to each agent, defining a work purpose for each agent, registering a unique identity for each agent, setting tokens, and setting access scope. It also includes revoking an agent's permissions at the same time when the owner leaves the company, as well as revoking the agent's permissions when the related account is revoked.

This approach separates AI agent permissions from user permissions and allows access only within the scope jointly permitted by both sides' permissions and tool policies. Softcamp presented this as a structure of 'user permissions ∩ agent permissions ∩ tool policy,' and said the final access decision is based on the permissible scope of user permissions, agent permissions, and tool policy. Accordingly, even if a user can modify a specific DB, a modification task is not allowed if the agent has only read permission.

In addition, personal access tokens (PAT) and secret keys are kept under centralized management, and the 'SHIELD AI Gateway' stores these PATs and secret keys and performs MCP server and API calls on behalf of the AI agent. This blocks the agent from directly holding keys and limits the resources and tasks the agent can access at the gateway. Kim explained that if AI agents are brought inside the organizational boundary, they can be controlled.

The AI analyzes the agent's API calls and task requests to assess risk. The analysis factors include API calls based on each agent's user permissions and the requested task content. Low-risk tasks are allowed based on the risk assessment results. Inquiry tasks are considered low-risk cases. Modification tasks may require approval. High-risk tasks, such as deletion, are blocked or require separate approval depending on policy. Because a 24-hour continuous agent's actions are difficult for humans to judge individually, the operating structure is one in which AI assesses risk and the manager checks the results.

Access to files inside a PC is controlled separately. The tool used is the 'SHIELD Agent Sandbox.' The scope of file access for AI agents is limited to approved workspaces, excluding the entire local storage. When files are brought into the sandbox, sensitive information is inspected or approval is required. When the agent accesses files, its identity and permissions are evaluated. Separate access permissions are also applied to the AI agent, apart from the user's document viewing permissions.

Softcamp said it has unveiled the 'AI Security Suite,' a control framework that bundles AI-related controls into a single suite. The framework consists of four solutions: 'SHIELD ID' handles authentication for people and AI agents, and 'SHIELD Gate' manages access to external generative AI. In addition, 'SHIELD AI Gateway' controls LLM, MCP, and API calls, while 'SHIELD Agent Sandbox' restricts access to local documents.

The framework is applied in a zero-trust manner, and at the time of a request it comprehensively evaluates conditions such as identity, data, tools, and device to decide whether to allow access, require additional authentication, mask data, require approval, or block the request. Kim said this is the time when AI security application and control are needed, and added that the goal is to guide AI agents so they operate within security policies.

Source: IT DAILY · Kim Byeong-ju
Original: https://www.itdaily.kr/news/articleView.html?idxno=241495

References

• https://www.itdaily.kr/news/articleView.html?idxno=241495