TechVoices

VIDEO PODCAST

SailPoint’s Chandra Gnanasambandam: AI Agent Governance and Identity Security

James Maguire

October 18, 2026

As enterprises rapidly deploy AI agents, identity security is evolving from relatively static access governance into a real-time system capable of managing both humans and enormous numbers of non-human identities.

In an interview at the SailPoint Navigate conference, Chandra Gnanasambandam, EVP of Products and CTO at SailPoint, discussed the growing complexity of enterprise AI, the need for continuous and adaptive identity security, and the challenge of governing autonomous digital workers.

He also explained why every AI agent ultimately needs human accountability, and why deterministic controls remain essential for high-stakes functions such as regulatory certification.

‍

Core Takeaways

Identity Security Must Become Real Time

Traditional identity governance has largely relied on static permissions, but SailPoint sees enterprises moving toward dynamic, just-in-time authorization that evaluates factors such as user identity, device health, network conditions and the sensitivity of the requested resource at the moment of access.

AI Agents Create a New Class of Identity

Enterprises must now govern not only employees but also agents, bots, service accounts, tokens and other non-human identities. Gnanasambandam argues that organizations cannot secure humans and AI agents separately; identity security increasingly needs to treat them as one interconnected “human plus AI” environment.

Every AI Agent Needs Human Accountability

As agents become more autonomous, enterprises still need to establish clear ownership. Gnanasambandam argues that every agent — including groups of agents operating autonomously — must ultimately be mapped to a human owner so organizations can establish responsibility, certification and accountability.

Deterministic AI Still Matters

SailPoint does not view deterministic and non-deterministic AI as an either-or choice. Instead, the company selects techniques based on the use case. Regulatory certification requires repeatable, deterministic results, while probabilistic AI can be useful for tasks such as analyzing user or agent intent, where some uncertainty may be acceptable.

KEY QUOTES

Enterprise AI Is Increasing Both Complexity and Velocity

“It feels like [enterprise complexity] has gone up almost by orders of magnitude. It's not just the complexity, but it's also the velocity of change. We're actually sprinting through the change and it's not like a slow roll. And so it's the combination of the complexity and the velocity, which is really compounding the problem.”

“I think it's fundamentally driven by the fact that we have a technology here, artificial intelligence, which has a potential to drive a level of innovation and productivity and unleash productivity in ways we have not seen... Twenty years from now, we will look back at this and say, ‘This was significantly more than what those [past] technology waves unleashed in terms of innovation, productivity, societal improvements, human experience, all of this.’”

Moving Identity Governance From Static to Real Time

In terms of static governance: "For the things that you are doing inside an application that are less risky or the data you're accessing that are less risky, that's fine." Real time governance: "Things that are more sensitive, critical, confidential, at the time of access, your risk should be evaluated.”

“One, to prove whether you are who you claim to be. And two is the context in which you are accessing — is that risky? That's my point about the quality of the Wi-Fi network, the device health and so on. And so that's a core of just-in-time authorization or just-in-time provisioning... It's a business transformation, security transformation.”

AI Agents Need Human Owners

“The most important task [is] mapping those agents to the owners and to the users. Because you can't take an agent to jail when it goes wrong. Who's accountable? Who's liable? And so that's why mapping owner assignment and user assignment... is a very, very critical exercise.”

“Every agent needs to be mapped to a human at some level — 100%. Even these autonomous agents where it's a group of agents that are autonomously acting, even those need to have some owner... In those cases, the owner of those marketing agents is the CEO.”

Choosing Between Deterministic and Non-Deterministic AI

“We are very mindful of what techniques, what artificial intelligence techniques, to use to what problems and what use cases... Certification, in our view, automating certification, we are very mindful that you have to use, for the most part, deterministic approaches because a lot of times certification is actually a regulatory need.”

“You can't really tell the auditor and the regulator, ‘There's no guarantee when you run the same exercise multiple times, you'll get the same result.’ By definition, you will not pass the audit... Certification is a great example where a deterministic approach is actually a must-have.”

ABOUT THE AUTHOR

James Maguire

Executive Director

An award-winning journalist, James has held top editorial roles in several leading technology publications, covering enterprise tech trends in cloud computing, AI, data analytics, cybersecurity and more. He regularly communicates with industry analysts and experts and has interviewed hundreds of technology executives. James is the Executive Director of TechVoices.

Cloudera's Venkat Rajaji: advantages of open source AI

Snowflake's Christian Kleinerman: AI and the speed of data access

David Linthicum: LLM trends

Extreme Networks' Nabil Bukhari: how AI democratizes technology

Komprise's Krishna Subramanian: an AI model for every task

Ahead of the curve, every week.

Get in touch with us.

Ahead of the curve, 
every week.