1. Identity & Access

How to manage human and non-human identity across AI platforms, including SSO, SCIM, RBAC, tenant restrictions, domain claiming, and agent service accounts.

Last reviewed: August 18, 2026

Identity is the first control. If you cannot enforce managed login and govern who has access to which AI platforms, every other control is built on sand.

Articles in this section

1. 1.1 SSO & SCIM for AI platforms
2. 1.2 RBAC across AI platforms
3. 1.3 Tenant restrictions: blocking personal accounts
4. 1.4 Domain claiming: bringing shadow accounts into enterprise
5. 1.5 Agent and non-human identity
6. 1.6 API keys and service accounts governance
7. 1.7 Human-in-the-loop and approval policies

Frequently asked questions

Is SSO enough to secure an AI platform? No. SSO controls the managed sign-in path. It does not automatically govern personal accounts, API keys, local credentials, workload identities, connector grants, or every hosted execution path. Pair SSO with lifecycle provisioning, tenant restrictions, capability-based roles, credential governance, and tested revocation.

How should agent identity differ from user identity? Use a dedicated, attributable workload identity for unattended or shared work. Give it narrow scopes, short-lived credentials where possible, a named owner, and a separate revocation path. Preserve the initiating user when a person launches the task.

Related handbook guidance

• AI Security Handbook
• 7.4 The vendor-neutral control matrix
• Security Team Checklist
• Glossary