Malik Haidar has spent years navigating the high-stakes world of multinational cybersecurity, where the line between a legitimate user and a malicious actor is often a matter of sophisticated analytics. As AI agents transition from experimental digital assistants to active market participants, Haidar is at the forefront of defining how these entities should be identified and controlled. In this discussion, we explore the friction between massive platforms, the evolution of identity protocols beyond human-centric models, and the urgent need for structural boundaries in agentic AI to prevent a total breakdown of trust in the digital marketplace.
The recent friction between Amazon and Meta over the Muse agent feels like a significant turning point for digital autonomy; what does this clash tell us about the current state of trust between major platforms?
It reveals that we are currently operating in a digital “Wild West” where corporate terms of service are the only real law because our technology has not yet caught up to the reality of autonomous software. When Amazon realized Muse was browsing and potentially storing credentials without their knowledge, they were forced to resort to reactive blacklisting and fingerprinting traffic patterns because there was no standardized “digital handshake” to rely on. This is a classic security problem wearing a new outfit; we are seeing one organization’s software acting inside another’s systems with no shared protocol to establish who—or what—is actually there. For years, we have relied on OIDC and SAML to federate trust for humans, but that bridge simply does not exist in a widely adopted form for agents yet, leading to the corporate sparring we see today.
Amazon currently requires agents to identify themselves via a text snippet in HTTP requests, but many experts find this insufficient; how would you describe the technical vulnerabilities of such a basic approach?
Requiring a static text snippet is essentially the digital equivalent of asking someone to state their name at an unmonitored door—it provides no real security because it lacks non-repudiation, tamper resistance, and contextual authorization. In a high-velocity shopping environment, a simple header doesn’t tell the host system if the agent has a legitimate delegation chain or if it is merely an unauthorized bot scraping data. This approach is brittle and expensive to maintain because it forces platforms to build ad-hoc gateways instead of relying on a cooperative, cryptographic protocol. Without a more robust standard, any agent could simply lie about its identity or bypass these basic checks, leaving the host platform with no choice but to implement aggressive and often disruptive blocking measures.
You have advocated for agents having their own distinct identities rather than just inheriting human credentials; why is this separation so critical for the safety of the end-user?
The default failure mode we see right now is an agent inheriting whatever access its logged-in user has, which makes it impossible to distinguish if a human performed an action or if an agent decided to do it autonomously. If an agent like Muse borrows a human’s credentials, it becomes functionally invisible to the system, which is a nightmare for anyone trying to secure a perimeter. We need to move toward a model where every agent is a registered non-human identity, linked to its human principal through a cryptographic delegation chain that verifies exactly which specific runtime was granted authority. This ensures that if an agent goes rogue or makes a non-deterministic error, we can trace the action back to the specific software instance rather than blaming the human user who may have had no idea what was happening.
At what point does an AI agent’s autonomy become a liability, and how can organizations design “human-in-the-loop” triggers that don’t disrupt the efficiency of the AI?
Autonomy becomes a liability the moment an action crosses a threshold into irreversible or high-stakes territory, such as committing funds, approving shipping destinations, or changing account access. We have identified four architectural boundaries that are critical here, and one of the most vital is ensuring that low-stakes actions like research or drafting can run autonomously, while “commit” actions require a human signature. Pragmatic security teams are establishing these boundaries prior to deployment, allowing the agent to prepare and stage a transaction while the human remains the final authority who signs and approves. By triggering step-up authentication workflows dynamically when a threshold is crossed, we maintain the speed of AI without sacrificing the safety of the user’s assets or data.
In a world of non-deterministic models, how do immutable audit logs change the way security teams investigate incidents involving autonomous agents?
In the aftermath of an incident, immutable, append-only audit logging is the only way to reconstruct a causal chain because you cannot simply interview an AI to understand its internal reasoning. When a security event spans across organizational boundaries, signed receipts and deterministic event logs become the sole mechanism for accountability and forensic analysis. These logs allow us to see if an agent’s requested action crossed a policy threshold or if there was a failure in the gateway enforcing the agent’s registered entitlements. It moves the conversation from “why did the AI do this?”—which can be a philosophical dead end—to “exactly what did the AI do and was it authorized?”, which is a question we can actually answer with data.
What is your forecast for the adoption of these shared identity protocols as AI agents become more prevalent?
I expect that the era of proprietary “fences” will soon give way to a standardized federation pattern because the cost of every developer engineering a custom handshake for every platform is simply unsustainable. While Amazon and Meta are litigating this through terms of service today, the hundreds of agents that will follow will require the structured cooperation offered by emerging standards like the OIDC-A extensions. We are reaching a tipping point where the industry realizes that an agent that polices itself is unaccountable, and an agent that borrows credentials is a ghost. Within the next few years, I forecast that non-human identity registration and external gateway enforcement will become as standard as the API gateways we use today, turning these corporate disputes into automated, secure transactions.
