What is agentic IAM?

Use Vault Enterprise so AI agents can obtain fine-grained access to secrets stored in Vault. Vault allows or denies access based on the intersection of Vault and Rich Authorization Request (RAR) claims specified in access tokens granted by an authorization server.

Vault supports using an IdP component or distinct authorization server for as the authorization authority. Supporting flexible authorization authorities ensures least-privileged, ephemeral permissions to the agent in scenarios where the agent is acting on its own or on behalf of a user.

Using a least-privilege approach implements zero trust principles by ensuring agent credentials are ephemeral and narrowly scoped through delegation.

The agent acts on behalf of a human developer and receives an effective permission set that is the intersection of three independent controls:

1. Human baseline ACL policies define what the person can do

2. Agent ceiling policies from the Vault Agent Registry cap the maximum the agent can ever do

3. Per-session RAR claims carried in the token specify what one session may access

For example, you can configure IBM Verify to function as an authorization server. IBM Verify then issues OAuth RAR tokens to an agent or other AI applcation, which that agent or application can then use to authenticate with Vault.

How the request flow works

Vault acts as an OAuth resource server and validates the OAuth-JWT token received by the agent from the Verify IdP authorization server. Operators register the AI agent with Vault in the agent registry so Vault can identify the agent and associate it with an entity for the applicable policies.

Review the Rich Authorization Requests (RAR) overview for a deeper dive into how RAR works with Vault.

The diagram illustrates the workflow where the human user (the subject) authenticates with an IdP (e.g, IBM Verify) and how the AI agent (on behalf of the user) can use the delegated RAR token issued by Verify to authenticate with Vault.