# nancy wang Published articles for nancy wang. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Three insights you may have missed from theCUBE's coverage of Okta's Oktane event DevFeed: [Three insights you may have missed from theCUBE's coverage of Okta's Oktane event]() Original publisher: [Read original article]() Author: Victoria Gayton Published: 2026-10-24T03:52:19Z Content type: news Language: en Sources: [SiliconANGLE]() Topics: [okta](), [Access Control](), [ai security](), [Multi Agent Systems](), [Single sign-on (SSO)]() Tags: [1password](), [agent-gateway](), [agentic-ai](), [agents](), [ai](), [ai-agent-governance](), [ai-agents](), [ai-security](), [auth0](), [bhakti-pitre](), [blueprint-alliance](), [charlotte-wylie](), [credential-broker](), [cube-event-coverage](), [dex](), [identity-security](), [jenna-cline](), [kevin-scott](), [krista-case](), [nancy-wang](), [news](), [okta](), [oktane](), [oktane-2026](), [onevu](), [pga-of-america](), [rebecca-knight](), [ric-smith](), [security](), [servicenow](), [shane-callahan](), [thecube](), [vanderbilt-university]() ### AI overview The article's central finding is that governing AI agents requires identity controls to follow their actions at runtime across connected systems, with vendors sharing responsibility. It describes the Blueprint Alliance's reference architecture and Okta's Agent Gateway, which moves Okta into the runtime path to evaluate what agents may do. Okta's Dex routes work to specialized agents with limited scopes. 1Password's Credential Broker supplies secrets without revealing them to agents or models, while ServiceNow and Okta are working on agent identities and session tokens to support containment decisions. The examples also point to existing governance as a starting point: the PGA of America uses Okta and Auth0 in a lean architecture without traditional data centers or a corporate network, and Vanderbilt is considering AI identities within established governance and technology intake processes. The article notes that conflicting platform decisions leave open questions about who has final authority and where it belongs. ### Source excerpt AI agent governance is moving identity security into the flow of work. As agents call tools, delegate tasks and act across applications, enterprises need controls that follow those actions beyond an initial login. The challenge is making those controls work across systems while preserving the business processes agents support. The limits of individual security platforms [...] The post Three insights you may have missed from theCUBE's coverage of Okta's Oktane event appeared first on SiliconANGLE. ## Autonomy creep: how AI quietly gains more authority than CIOs intend DevFeed: [Autonomy creep: how AI quietly gains more authority than CIOs intend]() Original publisher: [Read original article]() Author: Pat Brans Published: 2026-10-21T10:00:00Z Content type: article Language: en Sources: [CIO]() Topics: [Agentic AI](), [Artificial Intelligence](), [least privilege](), [Access Control](), [identity and access management](), [human review](), [Multi Agent Systems](), [agentic workflows]() Tags: [1password](), [access-control](), [access-control-artificial-intelligence-c-suite-careers-cio-data-governance-data-management-em](), [actions](), [agent](), [agents](), [ai](), [ai-agent](), [ai-systems](), [artificial-intelligence](), [automatically](), [autonomy](), [c-suite](), [careers](), [cio](), [cios](), [corporate](), [danger](), [data](), [data-governance](), [data-management](), [edition-us](), [emerging-technology](), [enterprises](), [identity](), [identity-and-access-management](), [identity-security](), [it](), [it-governance](), [it-leadership](), [it-management](), [it-strategy](), [language-en](), [lifecycle](), [nancy-wang](), [organizations](), [security](), [storytype-feature]() ### AI overview AI agents can quietly gain more authority as tasks expand, permissions accumulate, and human approvals fade. The excerpt describes the risk as especially easy to miss when systems perform reliably: NatWest says it reduces checks deliberately, with stakeholder and risk manager involvement and continued monitoring, while warning against approval becoming a rubber stamp. Suggested controls include defining each agent's task, permitted tools, success evidence, and prohibited actions, then using a separate verifier; placing enforceable limits in enterprise identity and access controls rather than relying only on model instructions; reassessing permissions as they change; and using task-based authorization with short-lived credentials instead of standing privileges. The excerpt also calls for named ownership and lifecycle responsibility, business accountability for process outcomes, and system-level visibility and traceability as agents interact. It notes that governance for multi-agent systems remains an emerging problem. ### Source excerpt Few CIOs are likely to suddenly decide to give an AI agent broad authority over corporate systems. The more likely path to autonomy is far less dramatic. An agent starts with a narrow task. It proves useful, so another system is connected. It then needs more data, so another permission is added. Then human approval becomes a bottleneck, so the organization removes it, and exceptions that once went to people start being handled automatically. Each decision may be sensible in isolation. Taken together, however, they can leave an agent with considerably more authority than anyone originally envisioned. That's the danger of autonomy creep. And as enterprises move from AI systems that recommend actions to agents that execute them, CIOs need to govern not only what those agents were originally designed to do, but what they have gradually become capable of doing. It starts with small permissions Jim Taylor, president and chief product and strategy officer at identity security company RSA, sees a familiar pattern. Organizations typically create an agent for a specific purpose and give it the permissions necessary to accomplish the task. Later, the job expands. "They just give it tasks, permissions; it just sits there and accumulates things," he says. "Over time, it develops potentially toxic combinations. It gets too much access and can see too much data. It can do too many things." width="1240" height="827" sizes="auto, (max-width: 1240px) 100vw, 1240px"> Jim Taylor, RSA RSA Humans accumulate permissions, too, of course, but organizations have developed processes around employees joining, changing roles, and eventually leaving. Agents may not have the same natural lifecycle. "They never give permissions back," Taylor says. Nancy Wang, CTO of 1Password, argues that CIOs should treat each expansion in an agent's responsibilities as something more consequential than another feature. "Every time you expand the scope of the agent's effective authority, you're essentially adding ## 1Password ties AI agent access to individual tasks DevFeed: [1Password ties AI agent access to individual tasks]() Original publisher: [Read original article]() Author: Jonathan Anthony Published: 2026-09-28T20:56:39Z Content type: news Language: en Sources: [SiliconANGLE]() Topics: [identity and access management](), [AI Agent](), [HashiCorp Vault](), [least privilege]() Tags: [1password](), [access-management](), [ai](), [ai-agent-access](), [ai-agents](), [ai-security](), [authorization](), [cloud-security](), [credential-broker](), [credential-management](), [cube-event-coverage](), [krista-case](), [nancy-wang](), [news](), [okta](), [okta2026eventpage](), [oktane](), [oktane-2026](), [rebecca-knight](), [security](), [thecube]() ### AI overview 1Password CTO Nancy Wang describes treating AI agents as hybrid human and machine identities. The company uses just-in-time, task-based access, checks permissions before agents move to subsequent tasks, and releases credentials only when needed without exposing them to the agent or underlying model. 1Password and Okta are also backing shared identity standards. ### Source excerpt AI agent access is complicating identity controls as agents log in, carry credentials and act on someone's behalf. They have characteristics of both human and machine users. That overlap can make actions harder to attribute: An agent may appear in an audit log as the person it works for, even though software took the action. [...] The post 1Password ties AI agent access to individual tasks appeared first on SiliconANGLE.