Okta's Identity Chief: Most CISOs Can't Answer This AI Question

Which AI agents can access what? Are those permissions even right? And can you stop a compromised agent mid-action? Okta's Dan Cinnamon says most enterprises can't answer any of the three.

Dan Cinnamon has built software, run SAP GRC without an implementation partner, and now architects identity for one of the industry's biggest players. In this conversation with Justin Beals, he lays out why "discoverability" — simply knowing what agents exist and what they're touching — is the single biggest blind spot in enterprise AI right now, and why there's no silver bullet coming to fix it. They also dig into passkeys as a rare win-win security standard, the maturing MCP spec, and where the hard line on agent containment should actually sit.

**Timestamps:**

0:00 Intro

1:20 From writing code to securing identity

4:45 Passkeys: the security/usability unicorn

8:30 The SAP GRC re-implementation story

14:10 Attribution and the agentic AI identity gap

18:55 How fast MCP has matured—and what's next

23:40 The 3 unanswered questions every enterprise faces

27:15 Granular identity vs. inherited permissions

32:00 Containment: moving controls closer to the data

36:45 Consent, provenance, and healthcare AI

40:30 Closing thoughts

#CISO #AIstrategy, #enterprise #AIsecurity, #agentic #AIgovernance, #Okta #MCPstandard, #zerotrust #AI agents