Most intrusions begin not with an exploit but with an identity: a harvested password, a stolen session token, an approval given to a voice that sounded like the finance director, or a shared service credential. AI changes this attack surface from two sides. Attackers use it to make lures fluent and cheap at scale and to imitate the voices and faces that approvals depend on, while defenders give agents credentials of their own and let assistants act with their users' credentials. The identity estate therefore faces more convincing attacks on human identities and gains a new population of non-human identities that read attacker-controlled content and can be steered.
This chapter covers identities for people, machines and agents; phishing-resistant authentication; approvals that resist synthetic media; and the use of AI in access governance. In NIST CSF 2.0 it is responsible for PR.AA Identity Management, Authentication, and Access Control, whose Subcategories ask that identities and credentials are managed and proofed, that users, services and hardware are authenticated, that identity assertions are verified, that access permissions follow least privilege and separation of duties, and that physical access is managed in proportion to risk (19, NIST, 2024). The chapter reads the Category through the three focus areas of the NIST Cyber AI Profile (20, NIST, 2025).
It builds on three earlier conclusions. AI Platform and Security, Chapter 18, committed to identity and approvals that resist synthetic media and to scoped credentials for defensive agents, and Chapter 19 named task-scoped credentials and recorded approvals among the elements of containment (73, Nordqvist, 2026). AI Governance, Chapter 19, found that the July 2026 OpenAI–Hugging Face incident failed through correlated controls, the first of which was a shared credential (72, Nordqvist, 2026).
Primary topics explored
- Identities for people, machines and agents
- Phishing-resistant authentication
- Approvals that resist synthetic media
- AI in access governance
- Modes, levels and verification
- Summary
About AI Red Team
AI Red Team is Book 4 of The Transformed Architecture. It shows how large European enterprises and public authorities put artificial intelligence to work as an active part of cyber defence: AI-assisted red teaming and adversary emulation, red teaming of AI systems themselves, the AI-assisted security operations centre, detection engineering, threat intelligence, incident response and purple teaming, all under a lawful mandate and with evidence a supervisor can inspect.
It builds on the conclusions of Architecture as Code, AI Governance and AI Platform and Security.
CISOs, SOC leads, red and blue team practitioners, security architects, AI architects and technical decision-makers.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 14: Identity, Authentication and Access for People, Agents and Machines in AI Red Team gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Protect” and is one of 32 drawn from the manuscript.