Explore how agentic AI is overwhelming traditional identity governance frameworks, with market consolidation, documented gaps, and practitioner consensus revealing that legacy IAM systems are fundamentally unprepared for dynamic, self-modifying AI identities at enterprise scale.
Verified Member
Her Story
About Carol
Carol Griffin is a technology and security leader with more than two decades of experience spanning telecommunications, enterprise infrastructure, technical program management, cloud transformation, security strategy, and technology education. Her career includes nearly 25 years with AT&T, where she advanced through increasingly complex technology and infrastructure leadership roles. She led large‑scale wireless and fiber infrastructure programs, enterprise migrations, modernization initiatives, capacity planning, data governance, risk control, executive communication, and financial portfolio oversight. Throughout her tenure, she directed initiatives supporting millions of subscribers and contributed to national infrastructure programs involving billions of dollars in capital investment.
Today, Carol brings her enterprise leadership experience into her work as a Microsoft Security Advisor through the Microsoft Community’s private NDA program, offering practitioner‑level guidance on identity governance, Zero Trust modernization, cloud security, and the evolution of Microsoft’s security ecosystem. She also serves as a Technical Thought Speaker with the Microsoft Speakers Hub, where she translates complex technology concepts into actionable insights and strengthens global technology community engagement.
Carol is the Founder of ROSE Tech Academy LLC (founded in her mother Rosie’s name), a learning initiative built to help adult learners rise into high‑demand technology careers through accessible, job‑ready training. She designed ROSE Tech Academy to bridge the gap between complex technical concepts and real‑world employment, creating practical pathways to financial independence and long‑term career mobility.
ROSE Tech Academy is guided by the R‑O‑S‑E core values:
Resilient Learning: Confidence‑building, hands‑on coursework designed for real‑world tech roles.
Opportunity for All: Affordable, flexible, and inclusive learning models built for busy adults.
Skills that Pay: Employer‑validated competencies, industry certifications, and clear employment pipelines.
Ethical Impact: Honest outcomes, learner support, and community give‑back in Rosie’s name.
Carol’s leadership philosophy is rooted in these values resilience, opportunity for all, continuous learning, and ethical impact principles shaped by her parents and her faith in God.
Her work increasingly focuses on the intersection of security, identity governance, artificial intelligence, cloud transformation, and human‑centered technology leadership. Across both her enterprise career and her work with ROSE Tech Academy, Carol is committed to helping people navigate an increasingly complex technology landscape with clarity, confidence, and purpose.
Her Interview
Ten minutes with Carol
01What do you attribute your success to?
I attribute my success to God and the foundation my parents provided. My parents taught me values that have guided me through every part of my personal and professional life.
My father emphasized discipline, independence, responsibility, and the importance of being able to stand on my own. He encouraged his children to work hard and made sure we understood what life looked like beyond childhood, expectations, accountability, and the reality of becoming capable adults. His lessons shaped my work ethic and my ability to navigate the world with confidence.
My mother taught me grace, humility, and how to treat people with kindness and respect. She raised her children with a calm, loving spirit and with patience.
Together, my parents provided different but equally essential parts of the foundation that prepared me for life. That foundation, along with my faith in God, continues to carry me through difficult seasons. When challenges arise, I draw on the values they instilled in me and the faith that has guided me throughout my life. Those principles have helped me remain resilient, continue learning, and keep moving forward in the hardest times.
02What’s the best career advice you’ve ever received?
The best career advice I’ve ever received was simple but powerful: keep going. Don’t let anyone stop you. Keep pushing, stay focused, and use good judgment to make the right decisions, and trust that God will take care of you.
03What advice would you give to young women entering your industry?
Remember that you belong in every room your work has earned you. Carry yourself with confidence, stay curious, and keep learning. And most importantly, trust that God will take care of you. The path may not always be easy, but resilience, character, and faith will carry you farther than anything else.
04What are the biggest challenges or opportunities in your field right now?
The technology industry is facing significant challenges and extraordinary opportunities as artificial intelligence, cloud computing, security, and autonomous AI agents rapidly evolve. One of the most critical areas is identity governance for AI agents and other non‑human identities. Traditional governance models were built around human employees and processes like Joiner‑Mover‑Leaver, but autonomous AI agents operate at a completely different speed and scale.
A key distinction enterprise must understand is the difference between describing what happened and preventing what shouldn’t happen. Identity, observability, and compliance reporting are largely retrospective controls, they create auditability, not real‑time intervention.
The only control that materially limits agent behavior in the moment is the checkpoint or approval gate. Telemetry tells you when an agent crossed a line; governance prevents the line from being crossed.
This becomes especially important in irreversible workflows such as financial disbursements, identity changes, vendor commitments, or customer‑facing communications. Those steps require hard gates. Everything upstream can operate with bounded autonomy and monitored freedom.
This is the adoption pattern we’re seeing across enterprises: agents are deployed first in workflows where the irreversible step is already gated, upstream reasoning and drafting run with less friction, and the approval gate becomes the organization’s enforceable “no.” Autonomy is only as safe as the gate in front of the step the agent cannot undo.
As organizations embrace agentic AI, questions around ownership, credential management, access certification, behavioral monitoring, and security controls are becoming urgent. The shift from human‑centric identity to machine‑centric identity is one of the biggest transformations happening in the industry, and one of the most important opportunities for organizations to strengthen security, reduce risk, and modernize their governance models.
05What values are most important to you in your work and personal life?
The values that matter most to me come directly from the foundation my parents gave me and my faith in God. Discipline, responsibility, and independence guide how I show up in life.
I believe in carrying myself with character, doing what’s right even when it’s hard, and using good judgment to make decisions that align with my values. I also believe in staying curious and continuing to learn because growth is part of leadership and part of life.
Most importantly, I believe in resilience and faith. Life will bring challenges, but when I stay rooted in who I am and trust God will take care of me.
Her Content Hub
Articles by Carol
THE IDENTITY GOVERNANCE TRIBUNE
How AI Agents Are Breaking Identity Governance Frameworks and What Practitioners Must Do About It
Agentic AI identity surges to the top of every analyst agenda, podcast feed, and vendor roadmap—as practitioners reckon with the uncomfortable truth that the frameworks they built weren't designed for this.
IDENTITY GOVERNANCE TRIBUNE
“2 out of 3 IGA programs already struggle to deliver on time. Now add AI agents that change their own behavior between certifications. We're not just behind—we're governing last week's identity in this week's environment.” That blunt assessment, delivered this week on the Radiant Logic podcast by identity analyst Simon Moffatt, landed like a stone in still water across the IGA community—and it captures a tension that every source, analyst, vendor, and podcast in this week's digest is circling from a different angle.
🎙️ THIS WEEK IN IDENTITY PODCASTS
Three podcast episodes are driving conversation this week, each approaching the agentic AI governance crisis from a different vantage point.
EPISODE SPOTLIGHT 1
Identity at the Center, Episode #441
Recorded live at Identiverse 2026, hosts Jeff Steadman and Jim McDonald welcomed two of the identity community's most respected figures: Sachini Siriwardene, winner of the prestigious Kim Cameron Award, and Ian Glazer, founder of the Digital Identity Advancement Foundation.
The conversation covered substantial ground: the AuthZen specification and what it means for externalized authorization; continuous access management as a replacement for point-in-time certifications; and—critically—how to separate genuine AI capability from the marketing hype now blanketing the identity industry. The episode also previewed a new industry honor, the Vittorio Bertocci Award, recognizing contributors to identity standards work.
"The question isn't whether AI belongs in identity," Glazer noted during the recording. "The question is whether the governance frameworks we're building today will still be meaningful in 18 months."
"The question isn't whether AI belongs in identity. The question is whether the governance frameworks we're building today will still be meaningful in 18 months." — IAN GLAZER, DIGITAL IDENTITY ADVANCEMENT FOUNDATION
EPISODE SPOTLIGHT 2
The Analyst Brief, E75: "Identiverse 2026"
Released June 30 and now circulating heavily on LinkedIn this week, Simon Moffatt and David Mahdi delivered what many practitioners are calling the sharpest post-Identiverse analysis of the year. The two analysts unpacked agentic identity, NHI security, and the wave of market consolidation reshaping the IGA landscape—including SailPoint's acquisition of Entro Security and Cisco's acquisition of WideField Security.
The thesis: market consolidation is not slowing down, and IGA+PAM+ITDR convergence is accelerating as vendors race to cover the AI agent governance gap. Organizations that are still running siloed identity programs are increasingly exposed.
EPISODE SPOTLIGHT 3 🔥 BONUS
Radio Logic feat. Simon Moffatt — Radiant Logic Podcast
Posted just two days ago on LinkedIn, this Radiant Logic podcast appearance by Simon Moffatt is already generating significant engagement. Moffatt opened with a statistic that stopped practitioners cold: 2 out of 3 IGA projects fail to finish on time or under budget—before adding that agentic AI layers an entirely new category of complexity on top of an already-strained discipline.
His core argument: most organizations are missing continuous, real-time observation of AI agent behavior—not just authentication. "You're not governing a static identity anymore," Moffatt said. "You're governing a moving target that is supposed to move—which breaks every assumption traditional IGA was built on."
"You're not governing a static identity anymore. You're governing a moving target that is supposed to move—which breaks every assumption traditional IGA was built on." — SIMON MOFFATT, IDENTITY ANALYST & RADIANT LOGIC PODCAST
🔥 HOT TOPIC: AGENTIC AI IDENTITY GOVERNANCE
This is the topic that won't quiet down—and this week, it is peaking.
Three converging forces are driving the urgency: massive market signals, documented governance gaps, and a crystallizing practitioner consensus that the old playbook is broken.
MARKET SIGNALS ARE LOUD
Saviynt launched Zuma—a purpose-built AI identity security platform—and followed it with a 12-city global roadshow (September 15 through November 20) with AWS as global sponsor. The roadshow's opening statistic is striking: 70% of organizations say AI systems hold more access than a human in an equivalent role.
Palo Alto Networks' new Idira platform, built from its acquisition of CyberArk's technology, explicitly targets agentic identity governance. SailPoint acquired Entro Security to close the NHI gap. These are not pilot programs or product experiments—they are billion-dollar strategic bets placed in a single quarter.
THE GOVERNANCE GAP IS DOCUMENTED
The NHI vendor map confirms that 92% of security teams are not confident that legacy IAM handles AI and NHI risks. The Identity Defined Security Alliance has announced a broadcast on September 23 specifically on AI agent identity protection—framing it as the fastest-growing, least-governed identity type in the enterprise.
PRACTITIONER CONSENSUS IS FORMING
Simon Moffatt's framing this week crystallized the problem in terms every IGA practitioner will recognize: you are not governing a static identity anymore. You are governing a moving target that is supposed to move—which breaks every assumption traditional IGA was built on.
📈 BY THE NUMBERS: AGENTIC AI IDENTITY IN 2026
- 92% — Security teams not confident legacy IAM handles AI/NHI risks
- 70% — Organizations where AI systems hold more access than equivalent human roles
- 80:1 — Ratio of non-human identities to human identities in the average enterprise
- 2 out of 3 — IGA projects that fail to finish on time or under budget
- $0 — Budget most organizations have allocated specifically for AI agent governance
- Sept. 23 — IDSA broadcast date: AI Agent Identity Protection
📅 MARK YOUR CALENDAR
📅 September 23, 2026 — IDSA Broadcast: AI Agent Identity Protection
The Identity Defined Security Alliance will host a focused broadcast on protecting AI agent identities—the fastest-growing and least-governed identity type in the modern enterprise.
Register at idsalliance.org
📅 September 15–November 20, 2026 — Saviynt UNLOCK 2026 Global Roadshow
12 cities. AWS as global sponsor. Anchored around the launch of the Zuma AI identity security platform and the statistic that 70% of enterprises say AI agents already hold more access than equivalent human roles.
Details at saviynt.com/unlock
📊 TRADITIONAL IGA VS. AGENTIC AI GOVERNANCE: THE GAP
DimensionTraditional IGA AssumptionAgentic AI RealityIdentity typeHuman users with stable rolesAI agents with dynamic, task-driven permissionsReview cadenceQuarterly or annual access certificationsContinuous, event-driven behavioral monitoringBehaviorPredictable; changes require provisioning ticketsSelf-modifying between certification cyclesOwnershipManager or role-based owner clearly definedOwnership often undefined at deploymentVolumeHundreds to thousands of human identities80:1 NHI-to-human ratio; scales exponentiallyAccess scopeRole-based, relatively static entitlementsBroad, often exceeds equivalent human role accessGovernance toolingPurpose-built IGA platforms (mature)Nascent; 92% of teams lack confidence in coverage
Join Influential Women and start making an impact. Register now.