Full Transcript for From Roles to Intent: Rethinking Identity in the Age of AI

have been like, seen the software industry from multiple different angles. Like I have been a system administrator protecting the machines themselves and the operating system and being a database administrator, Oracle database, SQL server database, DBA for some time. And I've been a application developer for a long time, mobile application developer. But the real aha moment was when I... ⁓ became an identity and access management administrator. That's when it was the intersection of everything. That's when I didn't realize that identity is the central thread. The core problem was like, who is this? Are you the right person? Are you allowed to be here? And are you allowed, are you doing, what are you allowed to do? So that sparked my passion. I was always passionate about cybersecurity, but this is where I found my niche in the identity. security and that landed me at Okta. Derek: Yeah, I love your role. Because what's super interesting I find, and we have this privilege as well, which is we are engineers building tools for engineers for all intents and purposes. You are a security professional building security tools for security professionals. And so, yeah, I'd love to understand just the area within Okta that you find yourself in and how you guys think about the work that you guys are doing in terms of your teams. Chandra Shirashyad: so my team, ⁓ lead the teams that build the front door. In a very simple ⁓ one ⁓ answer is like, my team is responsible for the front door. By that, mean like, think of us as like buffed up bouncers guarding the internet's most popular club. So ⁓ that you see at like, when you try to log in to ⁓ Okta, the first thing that you see is that, ⁓ well, my drop. ⁓ with the bouncer standing there, which is a sign-in widget. And then we're responsible for the SDKs as well, ⁓ which is the bouncers for the backdoor. So you can use authentication SDKs and you don't have to go through the sign-in widget, but you can build an application that uses our authentication SDKs. OctaVerify, that's the tool which is an authenticator, but it's not just an authenticator. Like many people think, ⁓ OctaVerify is an authenticator. It is, but it does a lot more things than authentication. ⁓ It's our primary device posture provider. It collects the signals from your device. And this is where digital helps us, like, know, harden our ⁓ application here, right? And in addition to OctaVerify, ⁓ we have assurance, which is basically, yeah, sure, we know who are. You have access, we'll you in, but the device that you're coming from is not compliant. Derek: Yeah, yeah. Chandra Shirashyad: It's not managed or it doesn't have, ⁓ you don't have a passcode on it. So we need to make sure that you are who you are, but also you are coming from a device that can be trusted. Derek: What I love about your solutions in this space generally is on one hand, it is some of the most complex ornate engineering efforts to get it right. On the other hand, when you get

it right, it's almost seamless. It's almost behind the scenes. And so there is a magic to level of complexity that to the end user, when done right, Chandra Shirashyad: Exactly. Derek: ⁓ It is a seamless, fluid ⁓ experience when you log into a new system or ⁓ trying to gain access to something obviously that you would be permissioned to gain access to. Chandra Shirashyad: Exactly. And the front door, what used to be like humans knocking on the door, now it's not just people knocking on the front door. Now it's like non-human identities, the machines, the AI agents, all of these. Even though my team's focus is changing a way that not just the humans are knocking at the door, but different entities, different kinds of identities are knocking. Derek: Yeah. Yeah. Yeah. Yeah. Well, so let's talk through that, right? Okta kind of came to fame or kind of came up in the cloud SaaS, you know, world. If you just want to think about it that way by sort of unifying and simplifying and enhancing identity across what I guess we will now all think of as like the beginning part of the internet. Now we have the AI dimension. How has Okta's mission to become the foundation of the identity layer on sort of the old mission, I think, which was like more deterministic applications and software to the new mission, which is that and AI and agents. Like, how has that evolved? How has that challenged your team? How are you guys thinking about? Chandra Shirashyad: I'll tell you one thing. Our core vision is not much has changed when it comes to our core vision. Our vision is free everyone to safely use any technology. And that's still very much true. If anything, it has been supercharged now. The definition of everyone and any technology has been changing. The word everyone now includes AI agents. That's the part I was talking about earlier. Now we are gone from being a bouncer at the door ⁓ for just ⁓ humans to like any kind of identity. ⁓ think of it as like a valet. Like you hand off your car key to that valet. We want to, that's an authentication. That person is authenticated. He or she is allowed to do something, but are they just doing what they're allowed to do? what they're authorized to do, which is to go and park your car and bring it back to you, or are they going to enjoy it? So that's the part which is what we should be taking care of right now. you, is allowing, have an agent you wanted to do a specific thing, pull a report for you. But it's supposed to have access to only a certain amount of data and not beyond that. It cannot have elevated its permission and go grab something that you don't have access to. So these are some of the things that are changing. The big conceptual shift is from static authentication, which is what used to be like rule-based. Here are the rules, you follow it, and then you let a person in to a dynamic trust, continuous verification, making sure that what is being authorized is what is being used for. Derek: It's super interesting

to me. think a lot of times for those of us in the industry, we're spending a lot of time thinking, okay, hey, there's a new Opus 4.6 comes out or ChachiBD 5.2 and then all the tools that are using it to be able to power the tools that we have access to. think often we're looking at the ⁓ capabilities of the foundation models as being like the delimiting factor. Whereas I think what we're seeing, and I'd love to get your take on this, in the enterprise, there's actually two non, well, there's two. different things that are potentially holding organizations back. One is classic, which is just generally organizational change, right? Having new ways of working, trying new things, getting out of doing things the way that they used to be done. And there's a whole bunch of techniques around driving that. But the other one that I think is maybe not so obvious to somebody from a distance is if you don't get identity right, it's almost impossible to roll these things out in large scale enterprises and maybe even more so in any regulated industry because you cannot have, to your point, it's one thing to give the agent access to get in, you can't have the agent doing a joyride on your data. And so talk a little bit about how your products are evolving to meet not only the obvious needs of the beginning stages of an agentic world, but also how do you stay up on everything when next week things are gonna change again? Chandra Shirashyad: Yeah, ⁓ So the identity is shifting from roles to intent, right? So earlier it's like you would hire somebody as a sales engineer, sales rep or a accountant and they would have specific ⁓ titles and then you buy that by the department they are in or role based depending on the permissions you have access to Salesforce, you have access to Workday, whatever, right? But that is changing. Derek: certain permissions, yeah, yeah, yeah. Chandra Shirashyad: Now it's the identity based on intent, right? It's not just who, but also what you're trying to do. Like if there is an agent which is running on behalf of an accountant, it's allowed to do certain things only. It cannot have access beyond what that particular accountant is supposed to have. What is the intent? And the second thing is about permissions, right? And these agents are... can run any time of the day, right? It's not like they're going to be there. And you cannot have standing permissions. These permissions have to be just in time. if an agent needs to run a query on a database to pull a report for an accountant, it should have not only just the limited amount of permission, but also just in time. You need access for 15 seconds or 10 seconds or even a fraction of a second to run that. And after the task is done, the access is revoked. Derek: Yeah, they don't sleep the last I checked, right? Yeah, yeah. Chandra Shirashyad: No standing permissions. And also ⁓ the scale, right? It's machine scale now. You cannot have like me or like an administrator sitting in and granting

access. It has to be automated. It has to be policy as a code, right? The access is granted at thousands of permissions or thousands of authorizations are given and revoked ⁓ per second maybe even, right? So that's the kind of scale we're dealing with here. Derek: Yeah, it is really interesting. mean, it is not just, so on one hand, to your point, there's a scale ramp, right? And so if I have, I don't know, if I have 10,000 employees and I've got 100,000 agents, there is clearly an order of magnitude scale difference. But to your point, it is a fundamental shift in how we even think about, quote unquote, identity, right? Because in the past, it's been an email address, a name, to your point, a job title, and probably a... series of permissions that are either checked or not checked, we are now moving to a dynamic environment where it's about intent. ⁓ in some ways, you could argue that intent is sort of ⁓ spans agents and humans, right? Like, because intent is ultimately the thing that's going to matter. interesting. Now, do you guys see, as you start to think about it, maybe we're getting a little bit into the future here a bit, but you alluded to it a bit, but like much like we have thought about identity or now intent ⁓ as bit of a, you know, what job is to be done. Let's say I'm on the legal team or I'm on the finance team. Is your hypothesis or what you're seeing that agents are going to be classified very similarly in the sense of they are going to be organized into certain functional areas. And then within that, they were going to have a set of things that they're allowed to do and not allowed to do. And frankly, as you highlighted, maybe times when they're allowed to do it and times when they're not allowed. Chandra Shirashyad: I mean, this is where like the relationship between trust, access, control. I mean, these are the things. Like the relationship among these like trust, access, and control is reversed now. Think of like, analogy would be like, know, ⁓ giving your teenager a credit card, right? So the access itself is a plastic card. You know, API key in the case of an agent, a AI and spending limits, like you want to make sure that, you know, how much they spend and then on what they spend. So these are the controls you need to have. And then you need to have trust. Obviously the model used to be no trust access control. ⁓ I trusted trust you. So I give you access and I have, I put some controls on it. Now here we have to do it the other way around. We have to start with, with limited access. I am granting you access to do specific things, but I'm gonna put some very tight controls. And then I'm continuously verifying the trust. I wanna make sure that you are doing exactly what you're doing and I am monitoring these things. then if ever like basically putting guardrails on AI. Yeah. Derek: Yeah, but it's a different paradigm. Chandra Shirashyad: Yes. Derek: Interesting. And so how do you think about when you think about the many organizations, the large scale organizations, even when we were just managing human identity that are maybe administrators and using the Okta tools and getting things set up, how is their job going to change or how is it already changing in this new AI? Chandra Shirashyad: So everybody is going become more efficient, right? Like we are seeing this in our development as well, right? So everybody is going to be more effective and get the productivity. ⁓ Everybody is going to gain huge amount of productivity again. However, we need to be extremely careful on usage of AI, right? So I would ⁓ think of AI as a over eager intern, right? So they, it's, it's, it wants to help you. It's a very, very eager and, you know, it's fast and wants to help you. And, but the thing is it might, it doesn't know the difference between what's like it's supposed to do and what it's not supposed to do. It can overstep its authority and go beyond because it's like, it's naive, right? It doesn't know. what is supposed to do. So an accountant may ask AI to do something and it can accidentally go and get access to something. This is where it can escalate its privilege. Privilege escalation might happen. That's where the identity comes into the picture, right? We have to make sure that the amount of access and authorization that is given to that AI agent is limited and it's delegated authentication. You have access to Derek: Sure, sure. Chandra Shirashyad: work on behalf of Derek or this accountant, and you can only do what that accountant can do. So that's the kind of things that we need to be able to put guardrails on when it comes to like professionals or. Derek: It's super interesting and I think you think about the traditional identity and access management administrator or you know, the IAM manager or whatnot. Their role has always been, hey, we got to really partner with the business. It's now more important than ever as you're starting to think about the adoption of additional agents and the evolution of. of managing intent and identity in this new world. Super dynamic, super interesting, and of course, Okta is very much at the forefront, both of what we know today, but also of the things that I think we're all learning as we go. So, Chandra, maybe pivot a little bit here. ⁓ You run engineering teams, right? You happen to be in this particular industry, but you run engineering teams. You've got a deep background, as you mentioned, across a whole bunch of roles. We talk a lot about at digital.ai that we have entered what we call the fourth wave of software development and delivery. And the context there is wave number one was procedural. Maybe even before the floppy disks, right, we had co-located teams. There was no obvious networks outside of maybe the physical location that you're in. And teams were co-located and they delivered in a waterfall fashion, not because they want to do, but that was the only way to deliver software when you had to go print the floppy disk,

right? Obviously the internet then, late 90s became obvious ⁓ and that unlocked ⁓ incremental or iterative delivery, which to me, The internet was as responsible for starting the wave of agile development methodologies as anything, right? Like it was core, I think object-oriented help, but like really modern tools and the ability to deliver software ⁓ every time you wanted to deliver software over the internet was like a real big unlock. Obviously we're sort of on the backside of what I consider more of a scale moment, which was around cloud and mobile and going from ⁓ a hundred million people ⁓ the internet. around 2000, 2001 to everybody being on, know, across as I'm sitting here, I got at least five devices connected to the internet for just me. We've now entered this new wave, right? And we went through the procedural, the agile development. I'd say cloud and mobile were kind of marked by scale, DevOps, like, you know, automation, et cetera. When you think about this fourth wave, How has it changed or how has it evolved Octus thinking around how you guys build the solutions that we all use? How you do engineering? How are you guys thinking about adoption? Chandra Shirashyad: Right. Yeah. There are three things that come to my mind, right? There are three shores I would call like, uh, one is how we build. engineers are like a few years ago, engineers used to start from scratch, right? you know, right? the, the, exactly. Yeah, exactly. And then I would, I used to have like good ideas, not that ideas were not there. Derek: blank slate of paper, right? Like just a blank whiteboard. Yeah. Chandra Shirashyad: The idea is, but I will still be writing the code from scratch pretty much. would take me a long time to do that. Now we have AI, as I said, like a super eager intern helping me, but that junior programmer is very fast. He can get me the first draft very, very quickly. And he does a fairly good job. And I can only imagine how, you know, what he... Derek: Yeah. Chandra Shirashyad: what that junior intern will be able to do in the next year or next three to four years. But already, the first draft of the code comes out really, really quickly. And that's what we're doing. We have rolled out copilot. We are using Gemini Code Assist and Cloud Code. So all of these are being, we are using this for productivity. And things that are very interesting are like, you we get the unit tests, the documentation. boilerplate code, refactoring, all of this is happening really, really fast. So we're using AI for our productivity. We want to be able to deliver ⁓ our time to market, which is going to be faster. The value to the customers will bring it much faster. And the second thing is what we build. It's how we build obviously helps with the productivity. What we build is also an important thing. And that's what we have been discussing all along. We have to change what we are building. Now we have to leverage AI in every aspect of our product. For example, we have OptaAI, which is helping in our identity risk, sorry, identity, ITD, identity, tech, detection and response, our risk assessment. authentication or the identity management has moved from just the front door to beyond like, it's not like, ⁓ I have a the front door and it's locked and it's secure. That's not enough. The threat can be afterwards as well. Like that's where AI is coming and helping us here. Has anything changed? Did your device posture? Derek was ⁓ on his mobile phone, logged into very sensitive application, but then he moved, he was in a car and he was connected to the home wifi and he went to a coffee shop. The threat immediately changed. The risk has changed. It's gone up. We need to do something. So things like that. Derek: Yeah. Yeah. Yeah, sure, sure. Yeah. Chandra Shirashyad: We are changing what we are building ⁓ with AI. And then ⁓ obviously the last thing is we're exploring what else we can do, like identifying bottlenecks, identifying vulnerabilities, and how can we design a more secure and more stable application and so on. So we are using AI in almost every aspect of our software development. Derek: I love it. It's one of the things that's super exciting about the industry that we both find ourselves in, which is when everybody asks, I don't know, if you go to a non-technical domain and ask the team, how are you using AI? They'll tell you, oh, well, we use a co-pilot like a Microsoft or a chat GPT or whatnot, helps us write emails, helps us respond to certain things, helps us summarize things. But for us, it's very nuanced because there's a set of things that are changing. Number one, we are using AI to get more productive at the tasks that we do, which is like building software. Number two, the software that we are building are helping people build AI-based software. And so we're going from deterministic applications. And I would say Okta historically has had to manage or help ⁓ secure identity for deterministic applications. Now you've got to do it in a non-deterministic world, which opens up a whole new route. ⁓ And then we're also saying with the advent of AI, what are the new opportunities that drive value that we never even considered before, right? And so it's so multifaceted. I sort of have to laugh a little bit when somebody says, ⁓ how are you guys using AI? I'm like, how long do you got? It's pretty complicated, right? Chandra Shirashyad: Yeah. So we are using AI the way they are using, which is for productivity. I, I, it polishes my email, it polishes my side deck. We're using everything that they are using it for. But in addition to that, we are also thinking how we can protect them from hurting themselves using AI, which is a differentiator between them and us, because we have to, not only we have to use like the way they are using to improve our productivity, but we also have to think then like, you know, what can Derek: Sure, Yeah. Yes. Yes. Yeah. Chandra Shirashyad: What harm can AI do? How do we

secure AI? How do you secure our customers from AI related issues? Like, ⁓ you remember that, I don't know if you know about this, there was a social engineering attack where ⁓ there was a room full of ⁓ people, like your own, like CEO and your finance CFO and everyone, like they were all fake. And somebody extorted like $2 million. Derek: Yeah, yeah, yeah, that's exactly right. Yeah. Yeah. Chandra Shirashyad: by making an accountant sign a cheque with entire fake people in the room. Derek: Jeez. Wow, yeah, I mean, this is a long way from the random WhatsApps that claim that I need somebody to buy me a Best Buy or Amazon gift card ASAP. Those were pretty rudimentary and easy to detect. To your point, everything's changing. And as we've talked about a lot, like obviously most of it, hopefully most of it is being used for good and for innovation as always. And certainly this was the case with mobile and web and others. Chandra Shirashyad: Yes. Derek: We got to also keep an eye on the fact that threat actors are using these things more aggressively and the level of sophistication is certainly growing. Yeah. Chandra Shirashyad: Both threat models have changed. The way we do threat models have completely changed now. Take AI into consideration now. Derek: Yeah, well, the scale that they can operate. talk a little bit about then, just as we start to think forward, and in particularly, what we just described, I mean, we're lucky enough to all day, every day be thinking this. You're probably similar to me. Even when I'm not working, I'm reading these things. I'm just a student of the space. It's as much my passion as is my career. ⁓ But it is a lot, it is moving fast. was just on earlier this week with a pretty senior first and at one of the foundation models. And I was like, one of the observations I have for myself is like, historically I've tried things, I've learned what it's good at, what it's not good at. And then that's how I kind of code my usage. ⁓ With the speed of innovation around the foundational elements, it's almost like you can't assume if something didn't work last week that it might not work this week, right? And all of those improvements are happening sort of behind the scenes. And she almost have to have this like very experimental mindset in everything you do. And you've got to assume that maybe it got better and let me try it. Try that same prompt again and see if it's improved as a leader in a forward leaning company. What are some of the techniques that you use to stay up to speed yourself? Chandra Shirashyad: I use AI. Yes. It's so awesome. You use AI to learn AI. We have several tools ⁓ within Okta. mean, one of the important things ⁓ for engineering leaders like us is to make sure that AI is used correctly. At ⁓ Okta, we have ⁓ Derek: It is ironic you can, yes, yeah, yeah. Chandra Shirashyad: had what's called as AI days, like company-wide AI days, right? And then we had a whole month of prompt ⁓ engineering. I wouldn't call it

prompt engineering. Basically, there was a training. Like every day, were given a challenge to write prompts. We have various training models. we ⁓ mandatory training, basically, on AI within the company. Everybody needs to become proficient with AI, basically. How do we use it? What are the nuances? Like the AI ⁓ can hallucinate. It's very verbose, for example. It just spits out way too many things. You need to know exactly how to ask AI and put the guardrails on it and make sure that you're getting the best out of it. And that's the kind of thing overall for everyone, it is important. But for engineers, it's even more nuanced. we need to, especially if you're using it to write code, we need to make sure that every line of code that the AI writes is weighted by an engineer, a senior engineer. Everything that AI writes is owned by, it's not AI, AI can write it. It can help me write the code, it should, finally it's my code. I should own Derek: Yeah, yeah, yeah. ⁓ The best way I've heard it stated, and I'll probably butcher this a little bit, but The best way I've heard it stated is there's this conversation, and you can insert the name of any job, ⁓ is AI gonna take my engineering job? Let's use that as an example. And the response I've heard that I think is most well thought out is you don't have to worry about the AI taking your job. What you have to worry about is the engineer who learns how to use AI better than you do taking your job. And I think that's the way we all need to think about it. Chandra Shirashyad: Yes, yes. Yeah, it doesn't take your job, but somebody who knows AI better will take your job. That's how it is. Derek: That's right. That's right. And this isn't the first time that's happened, right? I ⁓ highlighted this on a more recent podcast, there was an image a magazine somewhere that I was reading online, obviously, but ⁓ was from an office in the 80s. And I'm looking at it like there's very few computers, right? ⁓ There executives just sitting at desks with a phone, lot of stacks of paper. And they had to change the way that they worked, right? You think about now, you wouldn't go into any office without probably multiple big screens and whatnot. And this is very similar. It's another tool for the mind. It's another way for us to drive ⁓ innovation. Chandra Shirashyad: Yeah, the key is continuous education. It applies to you, it applies to me, it applies to a junior engineer, it applies to everyone in the organizations. If we don't keep up with the tools and the technologies that are evolving, which are happening much faster than before, by the way, which means we need to be able to pick up things really, really quickly. But it's not, at the same time, ⁓ are not that hard though. mean, picking up, ⁓ I said, like, you I use AI to learn AI. Derek: That's right. That's right. Yep. That's right. Chandra Shirashyad: If I don't understand something, ask ChatGPT or Gemini, hey, I don't understand this concept. Please can you simplify it and tell me in layman terms? It will give you very, very concisely. ⁓ Derek: Yeah, yeah, yeah. Yeah, I think that's right. I think probably the biggest thing holding anyone back, and this is probably the same for everything, is the old, it's always been done that way mentality. And as long as you have a let's try new things mentality in this day and age, to your point, it is democratizing the ability to learn how to do just about anything. ⁓ really, it's the onus is on the individual to kind of lean in and ⁓ almost disrupt themselves, right? You got to constantly be making yourself better. And I think it's a... Great. Thanks. Well, look, one of the things I want to close on, and this has been an awesome conversation. One of the things I wanted to close on is let's go back to Okta. Let's go back to identity. Let's go back to this dynamic time that we're in. When you start to look out, and I don't know what the appropriate time horizons ever are, six months, 12 months, 18 months, 24 months. When it comes to identity, when it comes to the importance of identity to usher in safely, securely this agentic AI future, what are some of the things that you guys are thinking about that maybe aren't, you know, kind of top of people's list right now, but you think they might be in a year or two. Chandra Shirashyad: Yeah. So for your listeners or for any engineering leader out there, I would say the single most critical thing is to win the unification battle. By that, mean, over the period of time, over the decades, your organization has a sprawling mess of identity silos. You have customer identity, have employees, have infrastructure, you have a bunch of engineers who have written code with API keys in there. So it's right now all over the place and it's a security nightmare already. And with AI coming in and people writing a whole bunch of ⁓ agents, it becomes uncontrollable. It'll become a nightmare for sure. And one thing that you could do is like, unify everything. You should have a central identity operating system. I'd call it the identity nervous system. And one single a glass of pain where you can control all the policies as opposed to like you know having all the different people controlling different kinds of identities different kinds of systems are managed by everything if you can otherwise you'll be playing a hopeless game of whack-a-mole so people are unifying Derek: This is a really good, yeah, it's a really, really good take. And we've seen this in some other areas. I was just having a conversation with a development leader on the podcast recently where one of the things we were talking about was the engineering organizations that had built more automation into their software delivery process pre-AI are the ones that are most ready to take advantage of the power of AI, right? Because they've sort of... got their house in order, they've gotten things organized and therefore the benefits that they're seeing around building more quickly, they actually are delivering more quickly. The ones that didn't, where there was a lot of manual stuff downstream, they're writing a lot more code, but they're shocked that they're not delivering anymore, right? But that's because they've not made those investments. And this idea of unifying identity, I've typed this down, I think it's probably fair to say, even if your company, maybe a customer or a potential customer, even if they are not Chandra Shirashyad: Yes. Derek: diving all the way into the deep end of AI. They need to be getting identity unified, organized, ready to go because otherwise they're going to be in a really tough position as things continue to evolve. Fair to say? Yeah. Chandra Shirashyad: Yeah, absolutely. That's exactly what I trying to do. I took a little bit much better than I did. Derek: No, no, this is great. Well, listen, Chandra, amazing to talk to you as always. We really always appreciate the partnership. You guys are on the forefront here. And I mean this sincerely. Without Okta, this revolution doesn't happen, right? Like it'll help one off people, but helping large enterprises, large organizations do this safely, securely, and hopefully as a collective for a long, long time, it's going to take you guys figuring out, you know, continue to do what you do, but also figuring out some of the new challenges, the new opportunities that are being unlocked. Thank you guys for doing what you do. Thank you for the partnership. Thank you for the time. And for those listening, we'll be back with another episode soon, but ⁓ we'll mark this one as a really great one, and Chandra, really appreciate it. Chandra Shirashyad: Thank you, Derek