Services
Focused advisory work on AI, identity, and accountability
Our custom services are delivered for enterprises that already have IAM, are already experimenting with AI, and now need their identity, access, and governance practices to catch up. Initially we focus on a small number of high-leverage questions and data points, then generate recommended options and translate them into a set of decisions that boards, CISOs, and security architects can all take and can all stand behind.
AI agent identity models
01AI agents are becoming first-class actors in your environment, but they often sit outside your current identity and access patterns and tools. We help you decide how to define, own, and govern those identities before they become unmanageable.
- Clarifying which automations, assistants, and agents should have identities of their own, versus operating strictly on behalf of humans.
- Defining ownership, lifecycle, and accountability for AI and automation identities, so it is clear who is responsible for what they do.
- Establishing baseline controls for credentials, secrets, and delegated access issued to and used by AI agents.
- Designing the minimum evidence you need to review agent behavior when something goes wrong.
What we see
Most enterprises already have AI agents running, but almost none have given them identities that their IAM stack can actually see. The result is a growing population of actors that cannot be audited, revoked, or explained to a regulator.
In practice
A typical question we hear
"We have dozens of AI automations running across teams. Nobody knows which ones have production credentials or who approved them."
What we usually find
Agents operating under shared service accounts, with no lifecycle management, no ownership trail, and credentials that have never been rotated.
What changes
A clear identity model that distinguishes agent types, assigns human owners, and connects each agent identity to the same governance stack used for people and systems.
Engagement patterns
- Board- and executive-ready framing of what an AI agent is in your environment.
- Architecture review and recommendations for how AI agents should show up in your IAM stack.
- A focused roadmap for bringing agent identities into line with your existing standards.
Access patterns for LLMs and data
02LLMs and retrieval systems change how data is accessed, combined, and remembered. Traditional least-privilege models were not written for prompts, context windows, API access, avoidance of application-enforced authorization and workflows, and embeddings.
- Mapping how prompts, tools, and retrieval systems touch sensitive data today, and where access is broader than it needs to be.
- Translating AI product and platform capabilities into concrete access rules, logging expectations, and guardrails.
- Identifying which data should never be exposed to certain AI use cases, even indirectly.
- Designing patterns for monitoring and reviewing AI-related data access that are realistic for your teams to operate.
What we see
The real risk is not that someone prompts an LLM with a bad question. It is that retrieval pipelines, tool calls, and context windows quietly combine data in ways that no existing access control anticipated or logged.
In practice
A typical question we hear
"Our internal AI assistant can search across HR, finance, and engineering data. We are not sure what it can actually see or whether anyone is reviewing that."
What we usually find
RAG pipelines pulling from broad data sources with no filtering by role or sensitivity, and no logging of what data was retrieved or surfaced to the user.
What changes
Concrete access boundaries at the retrieval layer, a classification of which data sources are exposed to which use cases, and logging that your security team can actually review.
Engagement patterns
- Targeted assessment of one or two priority AI use cases.
- Design review for a proposed AI platform or retrieval architecture.
- Joint working sessions with security, data, and product teams to translate policy into operating patterns.
Governance and oversight
03Boards and oversight committees do not need deep IAM internals, but they do need a clear view of how AI, identity, and accountability fit together. We help you build that view without overloading the agenda.
- Framing AI and identity risk in terms that are meaningful for boards and senior leadership.
- Identifying a small set of governance questions boards can ask consistently, quarter over quarter.
- Aligning management reporting so AI identity, access, and incident information shows up in a coherent way.
- Preparing board- and committee-level briefings that connect IAM and AI back to your broader risk posture.
What we see
Most boards receive AI updates that are either too technical to act on or too vague to challenge. The missing layer is a small, consistent set of questions that connect AI activity to identity and accountability in terms a board can use quarter over quarter.
In practice
A typical question we hear
"The board wants to understand our AI risk posture, but every briefing turns into a product demo or a list of initiatives. We need something they can actually govern."
What we usually find
No repeatable governance structure for AI and identity. Reporting is ad hoc, metrics shift between meetings, and the board has no stable frame to track progress.
What changes
A compact governance question set — five or six questions the board asks every quarter — with supporting data that management can prepare without building a new reporting stack.
Engagement patterns
- One-time board or committee briefing on AI, identity, and accountability.
- Design of a recurring governance question set for AI and identity risk.
- Support for management in preparing board materials and narratives.
Architecture and control design
04Security and identity teams need AI-era controls that mesh with the systems they already run. We focus on structure and decision-making, not on selling a particular product.
- Reviewing current IAM, logging, and monitoring capabilities against your AI roadmap.
- Identifying where existing controls can be extended to cover AI agents and workflows, and where new capabilities are actually needed.
- Suggesting patterns for approvals, segregation of duties, and exception handling that take AI into account.
- Helping you choose among implementation options and vendor approaches without acting as a reseller.
What we see
Security teams are being asked to approve AI architectures that do not fit their existing control models. The pressure is to either block everything or approve everything. Neither works. What is needed is a structural view of where existing controls extend and where new ones are actually required.
In practice
A typical question we hear
"Engineering wants to deploy an AI platform across three business units. Security has been asked to 'sign off' but we do not have a framework for what controls should apply."
What we usually find
An approval bottleneck where security reviews AI proposals case by case, with no reusable patterns for identity, logging, or access control that engineering can build against.
What changes
A set of reference patterns — identity models, logging requirements, approval workflows — that security and engineering teams agree on once and apply across AI initiatives, reducing friction and improving consistency.
Engagement patterns
- Architecture review of a proposed AI-enabled system or platform.
- Focused working sessions with identity, security, and engineering teams.
- A pragmatic, time-bound roadmap for strengthening controls over 6 to 18 months.
How we work with you
Most work begins with clarifying where AI and identity are already interacting in your environment, then moves into scoped advisory work shaped for boards and security teams.
Briefings
Focused sessions for boards, executives, or leadership teams on AI, identity, and accountability, tailored to your current questions.
Assessments
Short, bounded reviews of specific AI use cases, architectures, or identity patterns, with concrete findings and options.
Ongoing advisory
Time-boxed advisory relationships where we stay close to a set of initiatives and help your teams make and defend decisions.
Where to go next