Zero Trust In The Age Of AI: Why Identity Must Become The Enterprise Control Plane

Vikram Pande, Deputy General Manager at HCLTech.

Most enterprises did not design their identity architectures for a world in which software could act on behalf of people, yet that world is arriving quickly. AI copilots, intelligent agents, service identities, APIs and automated workflows can retrieve information, initiate transactions and interact with enterprise systems.

For technology leaders, this creates a strategic challenge. The next phase of zero trust cannot focus only on proving that an identity is legitimate. Organizations must also determine whether a human or machine identity should be allowed to perform a specific action against a specific resource under current conditions.

That is why I see identity increasingly becoming the enterprise control plane.

The real challenge is not logging in.

Many zero-trust programs begin with authentication. MFA, conditional access, passwordless authentication and device-compliance controls strengthen the front door, but successful authentication does not automatically mean appropriate access.

A legitimate user may still have excessive privileges. A compliant endpoint may provide access to information the employee no longer requires. An AI agent may authenticate correctly while receiving broader access than its task warrants.

The challenge, however, is not simply designing more granular identity controls. It is making those controls work consistently across a complex enterprise, where security requirements, business processes, legacy systems and employee experience all intersect.​​

One of the most important lessons I’ve learned from leading large-scale identity and workplace transformations is that security architecture alone does not determine whether a program succeeds. The operating model does.

By treating identity as an enterprise change in operating model rather than a security-only initiative, password reset requests were cut by about 90% while enhancing authentication capabilities.

• Who is responsible for this agent?