AI IAM Reference Architecture
Identity and access management for AI-native systems.
AI systems introduce non-human actors that can retrieve data, call tools, invoke models, and generate outputs. AI IAM defines how those actions should be authorized, enforced, and audited.
Core Thesis
Traditional IAM was designed around users, applications, and resources. AI systems require authorization across users, agents, tools, data, models, and outputs.
What AI IAM Governs
Users
Agents
Tools
Data
Models
Outputs
Agents become first-class identities
AI agents need identity, ownership, scope, permissions, and auditability.
Authorization becomes continuous
Access must be evaluated across the full execution chain, not only at login.
Data must be controlled before the model
The model should only receive context the user and agent are authorized to access.
Outcome
A system where every AI action is identity-aware, purpose-bound, policy-evaluated, risk-adjusted, and auditable.