- CIOsurge
- Posts
- Your AI agents are identities you cannot see
Your AI agents are identities you cannot see
Plus: the open standard coming for agent verification, and the Senate bill that would make you track every one.
Zack Tembi
July 14, 2026
Your AI agents are identities you cannot see
Powered by Single Fin
Welcome to this week’s edition of CIOsurge!
This week:
Tim Youngblood on why an errant agent action at machine speed is a completely different kind of problem
The Linux Foundation is building an open standard to verify AI agents across the internet
The Senate's AI AGENT Act would force you to trace every agent back to a human
Let’s make this week a game-changer.
Stay sharp. Stay ahead.
When AI Agents Act 1,000 Times Faster, Runtime Becomes the New Security Frontier
In my conversation with Tim Youngblood, the first CISO at Dell and a veteran security leader at T-Mobile, McDonald's, and Kimberly-Clark, we got into the wave he thinks is reshaping security right now: identity as the new perimeter, and the AI agents moving through it.
Tim has watched every major shift, from antivirus giving way to EDR, to cloud, and he frames this one the same way. "Identity is a new perimeter, and along with that is the evolution of AI and now AI agents. We've got this new digital workforce that's come into the environment, and people are trying to figure out what to do, because it changes how you view identity, how you access data, endpoint security, all of it."
The part that sharpened my own thinking was his point about actions at machine speed. His example was an AI agent handling patient health data. "If that agent takes an errant pathway and starts sending information to the wrong patients, it happening one time, okay, that's a problem. But AI can take action 1,000 times more than a typical human. So 1,000 times of that happening is a completely different kind of problem." Whether the cause is malicious or just a learning error, the moment an action happens now carries far more weight.
This is exactly why I keep pushing on runtime. A lot of the identity companies that came to market a couple of years ago focused on governance and setting up guardrails, which matters, but the piece many of them miss is runtime control: actually preventing shadow IT and stopping people from using unsanctioned third-party AI tools in the moment. If the governance rail is not built, people will find a way around it. Runtime is a critical component for the future of AI security.
The takeaway for security leaders: the old stack was built to watch humans, and AI goes around all of it. You need visibility into what AI is actually doing across identity, data, and endpoints, and the ability to catch a bad action at runtime, not in a report after the fact. Governance without runtime enforcement is a rule nobody is checking.
The Linux Foundation Is Building an Open Standard to Verify AI Agents
The Linux Foundation is preparing the Agent Name Service, an open standard built on DNS that would let enterprises authenticate and identify AI agents at scale as they operate across the internet. The foundation said enterprises face growing challenges authenticating and governing agents, and that extending proven DNS infrastructure to AI agents addresses the security and identity challenge before it gets out of hand. The urgency is visible in the numbers. Only 11% of technology executives feel prepared for the scale of agentic AI deployment expected over the next year, according to IBM's Institute for Business Value, and two-thirds of CIOs and CTOs say they are held accountable for AI systems they cannot fully control. Governance frameworks are not keeping pace with agentic adoption, according to Deloitte.
Trusted identity infrastructure for agents is about to become table stakes, and most of us are not ready. The instinct will be to wait for the standard to settle before doing anything. That is the wrong move. You do not need ANS to start an agent inventory, assign each agent an owner, and scope its access. Do that work now, while your agent count is still small enough to map by hand. When the standard lands, you will be adopting it. Everyone else will be excavating.
— Zack Tembi
The Senate Bill That Would Make You Trace Every Agent Back to a Human
Senator Mark Warner's discussion draft, the AI AGENT Act, would require providers of "custodial user agents" to register with the Federal Trade Commission before accessing interfaces maintained by large online platforms. The bill defines such agents as software authorized by a user to act on their behalf in a transparent, documented, limited, and revocable way, and would require large platforms to support access by approved third-party agents. For enterprises, the proposal is an early regulatory test for agentic AI. Linking an agent to the user who authorized it creates a continuous traceability requirement for that agent's actions, which could force CIOs and CISOs to rethink how they track agent activity and assign responsibility for automated decisions. Analysts noted it could also expand incident response planning to cover actions initiated by AI agents, with revocation likely proving the most consequential issue, since companies must be able to define what access is being withdrawn and across which systems.
Regulation is arriving before most organizations have an agent inventory, and that ordering is going to hurt. Continuous traceability from an agent's action back to the human who authorized it is not a compliance checkbox you bolt on later. It is an architecture decision. If you cannot today produce a list of every agent, its owner, its scope, and a log of what it did, you are not going to produce one under a deadline. The revocation piece is the sharpest test: pull an agent's access right now and see whether you actually know every system it touched.
💡 CIO Spotlights
Ram Krishnan named Chief Information Officer at Lobel Financial
Appointed CIO of Lobel Financial, a consumer finance company specializing in the purchase and servicing of automobile contracts
Will lead technology strategy, digital transformation, information systems, cybersecurity, and IT operations
Brings deep experience across product strategy and delivery, go-to-market execution, cloud technologies, security, analytics, enterprise software, risk management, and compliance
Mandate includes strengthening cybersecurity and data governance, modernizing core platforms, and identifying emerging technologies to improve operational efficiency
Reply