AI agent identity: Okta asks 3 questions on September 2, 2026 — AppH's product already answers them, without a dedicated platform
On September 2, 2026, Security Boulevard published a piece by Okta/GuidePoint Security: AI agents are a new class of identity moving through the enterprise without the controls already in place for people — hence three questions few organizations can answer: where are my agents, what can they connect to, what can they do. At large enterprises, the answer runs through a dedicated identity platform (Okta, in this case). At AppH, the same three answers already exist — not as a paid add-on, inside the product itself.
According to Ariel Zommer (Okta, Security Boulevard, September 2, 2026), AI agents are spreading through the enterprise faster than any earlier technology wave, often without the accountability already required of people and applications. The piece cites a real incident: a compromised OAuth connection between a corporate account and a third-party AI tool opened a path into internal systems (API keys, tokens, environment variables) — not a software flaw, an identity problem. It also cites a hard number (Stanford SACR, March 2026): 53% of public MCP servers use static secrets, and only 8.5% implement OAuth. The piece proposes three questions as a foundation: where are my agents? what can they connect to? what can they do? — and for the third, it explicitly recommends human-in-the-loop controls for high-stakes actions (changing a production environment, accessing regulated data, initiating a financial action).
The solution the piece proposes — a dedicated agent identity platform, with inventory, short-lived revocable permissions, approval workflows, centralized logs — is the right answer for a large enterprise running dozens of agents from different vendors. But building or buying that platform is out of reach for a small business, which has neither the security team nor the budget for a dedicated Okta project. AppH answers the same three questions differently: not through a separate identity layer to administer, but because the product already ships with the answers built in. Where are my agents? — every automated AppH action (a sorted email, a reminder draft, a status change) lands in the same audit log as human actions, with an identified actor, viewable module by module (a history panel already live across ten-plus verticals). What can they connect to? — every module's data scope is bounded to its own domain (an agent handling billing never touches clinical records), and external connections (webhooks, API keys) carry their own rotatable secrets, with an automatic alert if a key sits active and unused. What can they do? — it's the human approval click on any action with real consequence, already covered in today's earlier piece on the Forbes op-ed: money moving, a cancelled booking, an outbound message to a customer, a sensitive record changing hands.
For AppH
- The three questions the piece sets as the foundation of an agentic identity strategy — where, what-to, what-can-do — already have a built answer at AppH, without an SMB customer having to evaluate or buy a separate identity platform.
- Actor-level attribution in the audit log (already in production across ten-plus modules) matches exactly what the piece describes as the standard to reach: logs that are "attributable, auditable and actionable."
Against / the honest limit
- AppH has no formal agent-identity directory with a declared owner and lifecycle state per agent — because every AppH agent belongs to the same product, a simpler case than the multi-vendor sprawl the piece targets; the day AppH lets third-party agents connect via API, that gap becomes real.
- There's no "kill switch" to instantly cut a specific agent's access across every connected system — the closest thing AppH has today is the alert on a dormant API key, not an immediate, centralized revocation.
What stands out in this piece isn't the novelty of the risk — mismanaged identity is an old security problem — it's how fast AI agents are making it reappear at a scale few security teams anticipated. For a large enterprise, the answer is a project: evaluate, deploy, administer a dedicated identity platform. AppH starts from a different, more modest but equally defensible premise: a small business has neither the time nor the budget for that project, so the answers need to already be in the product on day one, not a box to check later. We're not claiming to cover everything a platform like the one this piece describes covers — the missing agent directory and kill switch are the honest proof of that. But of the three questions it asks, none goes unanswered at AppH: it already exists, and a human remains the last step before anything expensive to undo happens.
Verified by a human at AppH