zdnet-cisco-duo-interview-article-header
Cisco / Matt Caulfield

Agentic AI promises to transform business strategy from the ground up. But it also poses a serious challenge to IT leaders. You don’t want to slow your teams down in experimenting with autonomous agents and miss a competitive window for productivity and revenue gains. At the same time, you’re navigating a technology that evolves from week to week and, at a scale many can’t even fathom, could be putting your systems at risk. 

“Somewhere in your environment right now, an AI agent is almost certainly operating without a proper identity, a defined owner, or any meaningful access controls,” Cisco VP of Product for Identity Matt Caulfield, who leads the team behind Duo Agentic Identity, told ZDNET in an email. “Developers are already connecting these agents to production systems without looping in IT, and that is a massive security blind spot.”

Harnessing what agentic AI can do, without absorbing risk most organizations can’t yet quantify, is crucial for long-term strategy. This means rethinking identity management for your enterprise and reimagining what’s possible.

Traditional identity management stretched to the breaking point

AI agents are autonomous actors, capable of querying databases, triggering workflows, sending communications, and making decisions on their own, at machine speed, sometimes with the option to forgo human permission or intervention. That autonomy is precisely what breaks the assumptions built into nearly every identity and access management system currently in use.

A traditional human identity is defined once, at onboarding, and updated every so often after that. An autonomous agent, by contrast, often inherits whatever credentials happen to be sitting in the context it’s running in, which can provide it extremely course-grained access to whatever action it decides to take.

The tools built to manage non-human identity before agentic AI existed weren’t built for this, either. “Those tools were designed around service accounts and API keys. In other words, predictable, static entities,” Caulfield says. “They were never built for the kind of per-action, per-session enforcement that an autonomous agent demands. The result is a gap that’s widening every quarter: Businesses are adopting agents faster than IT can figure out how to govern them.”

Adapting Zero Trust for the agentic era

This architectural mismatch seemingly leaves organizations with an uncomfortable choice: deploy agents at the speed the business wants and accept risk that’s difficult to even measure, or hold agents back and watch competitors capture market advantages that won’t wait around. But Caulfield said he doesn’t think that’s actually the choice.

“The real task isn’t picking between speed and safety,” he said. “It’s building enough trust between humans and agents that you stop having to choose.” Caulfield’s team at Cisco has adapted Zero Trust principles to apply to a new, broader class of non-human actors:

  • Never extend implicit trust
  • Never grant more trust than the task requires
  • Continuously verify the trust that’s already been given

Structurally, that means organizing the response around three pillars: comprehensive visibility, rigorous accountability, and enforcement that operates at the level of a single action rather than an entire session.

Bring autonomous agents into the light

Bringing autonomous agents into the orbit of identity management starts with visibility. Cisco’s clients frequently identify this as their number-one problem. 

“You can’t trust what you can’t see,” Caulfield said. “There are shadow agents running in almost every environment we look at. There are agents a developer stood up to solve one problem that connected to a handful of internal systems then moved on.”

The way Cisco makes that discovery possible builds on top of its existing systems for a total architectural solution that’s more comprehensive than most systems that work purely at the identity-verification level. Most identity-management systems only see entities that explicitly request verification, which autonomous agents often don’t.

“Because Duo Agentic Identity is built on the Cisco platform, we’re not limited to that,” Caulfield said. “We also see what’s communicating across the network. That combination is what lets us catch a shadow agent the moment it starts operating.” 

The result, delivered through an extension of Cisco Identity Intelligence, is a continuous, real-time inventory of every active AI agent in an environment, rather than an occasional scan that might even go stale before it’s finished running.

Every autonomous agent gets an owner

Discovery only gets an organization halfway there. An agent that’s been found but not governed is barely an improvement over one that was never found at all. In both scenarios, the accountability piece is still missing.

“Once you know an agent exists, it needs a full identity lifecycle, the same way a new hire does,” Caulfield said. “It needs to be onboarded with clear ownership, monitored the whole time it’s active, and formally offboarded the moment its job is finished.”

Duo Agentic Identity‘s answer builds on Cisco’s Duo Directory, treating every agent as its own first-class identity object, rather than a proxy standing in for whoever built it. With native support for OAuth 2.1 and the emerging Model Context Protocol (MCP) built in, the approach is neutral about which framework or vendor an agent happens to run on.

“Every agent gets mapped to a specific human owner and slotted into groups for policy, the same as we’d do for a person,” Caulfield said. “Every action it takes gets logged and tied back to that owner, so there’s an actual sponsor behind everything an agent does.” 

Give autonomous agents only the tools needed for the job

Overprivileged agents are, in Caulfield’s assessment, the single highest-risk condition in any agentic deployment, and the fix has to operate at a finer grain than security teams are used to. 

That enforcement runs through an MCP gateway, a checkpoint that sits between an agent and the tools it’s trying to use. Cisco’s gateway intercepts every request an agent makes, evaluates it against a fine-grained authorization engine, and either permits or blocks the action before it ever reaches the target system. For example, an agent might be cleared to read a customer record, but then blocked if it tries to export it. Or an agent might be allowed to draft a message, but blocked if it tries to send it without a person signing off.

“That’s the level of control this has to work at,” Caulfield said. “Not ‘Can this agent use this tool?’ but ‘Can this agent take this specific action, right now, under these conditions?'” The policies themselves can be scoped down to exact conditions and operations, giving IT teams control per tool call, rather than per session.

Identity management is a foundation for scalable agentic AI

The promise of agentic AI — faster operations, smarter automation, and workflows handled end-to-end that used to require a whole team — is real. But Caulfield is emphatic that this value is only safe to pursue once it sits on an actual foundation of trust between the humans running a business and the agents acting on their behalf.

“The organizations that will manage agentic AI risk effectively are the ones establishing governance frameworks now, before agents proliferate to the point where retroactive governance becomes a remediation project,” he said.

Comprehensive visibility, real accountability, and permissions enforced at the level of a single action are, in that view, not a brake on agentic AI. They’re what make it safe to actually use.

“Security and governance are the biggest blockers to mainstream Agentic AI adoption right now,” Caulfield said. “Organizations that solve these problems will finally see the gains they’ve been hoping for on agentic AI in production.”