Skip to content
PlainID

Authorization, written down.

Field notes, best practices and market reading from the team building identity-first authorization for the enterprise.

Sep 23, 2026

How runtime authorization helps turn EU AI Act requirements into enforceable controls

The EU AI Act is here. It entered into force in August 2024 and became generally applicable on 2 August 2026. For any organization deploying AI in a regulated market, it now sits inside the operating environment, or at least it should.

Rakesh Chowtee

Sep 2, 2026

Governing AI Agents: The 5-Layer Blueprint for Agentic IAM

Every industrial revolution has forced organizations to master a new control discipline—and the scaling of agentic AI is no exception. As enterprises deploy autonomous software that interprets goals and makes dynamic decisions, legacy static permissions are no longer enough. On the front lines of enterprise security, iC Consult—the leader in implementing complex IAM solutions - is seeing first-hand in the market how fast these unmanaged AI workloads are expanding. iC Consult, the premier global IT security provider that implements enterprise IAM on the front lines and sees the market shift first-hand, has partnered with PlainID, the leader in Agentic AI Access Management for Fortune 500 enterprises. Together, we are bridging the critical gap between passive "AI safety" content filters and true execution control by uniting identity and security under a single operational model: Agentic IAM.

Gal Helemski

Aug 31, 2026

How to Get Started with Authorization Strategy

Most enterprises already feel the pressure to upgrade their authorization systems to meet the requirements: fragmented policies, inconsistent enforcement, limited visibility, and growing gaps as new technologies, especially APIs, data platforms, and AI systems, are introduced. The challenge that comes with them is executing that change without disrupting the business.

Gal Helemski

Updates

Sign up for updates

Get the latest news on identity, access management, and policy enforcement directly to your inbox.

Aug 25, 2026

From Security Control to Strategic Enabler: The Business Drivers Behind Modern Authorization

Authorization has traditionally been positioned as a technical control; a necessary component of security architecture, but rarely a strategic priority. It was something implemented within applications, managed by engineering teams, and revisited only when something broke or a compliance requirement demanded it. That perspective is rapidly becoming obsolete.

Gal Helemski

Aug 13, 2026

AI Agent Authorization: Why Static Roles Break

Give an AI agent a role, and you've made a bet you can't take back easily. The agent holds that role at 3 a.m. just as firmly as it does during a live incident review at 10 a.m. It holds that role whether it's answering a harmless FAQ or reaching into a finance database it was never supposed to touch for this particular request.

Gal Helemski

Aug 13, 2026

SaaS Authorization: When Access Reviews Fall Behind

A quarterly access review tells you who had access on the day someone ran the report. It says almost nothing about the days on either side of that snapshot, and that's exactly where most SaaS access problems live. Your review calendar might say everything checks out. Meanwhile, a contractor's Salesforce token from a project that wrapped in March is still active in July. A marketing hire's Workday permissions never got scoped down after she moved teams. An AI agent someone spun up to summarize support tickets has quietly picked up read access to two data sources nobody approved. None of that shows up until the next review cycle, if it shows up at all.

Gal Helemski

Aug 13, 2026

What Is Relationship-Based Access Control (ReBAC)?

Relationship-based access control decides who gets into a resource by checking how two things connect, not by checking a list of roles. A doctor opens a patient's chart because the system has linked that doctor to that patient. "Doctor" alone carries no blanket permission to every chart in the hospital. Security teams shorten the name to ReBAC, and once you know what to look for, you see it everywhere: a file shared with one colleague, a repository owned by a single team, a folder that only appears for the people invited into it.

Gal Helemski

Aug 5, 2026

How Microsoft and PlainID Extend Trust Through Agentic Workflows

Picture a routine agentic workflow: a user delegates a task, and an AI agent takes it from there, querying a data platform outside Microsoft's ecosystem, calling an external API, invoking an MCP tool, updating a custom application, all before a human looks at it again.

Gal Helemski

Aug 5, 2026

Agentic AI Governance: A Complete Guide

Agentic AI governance is the set of authorization policies and runtime controls that determine what an autonomous AI agent is permitted to access, decide, and execute, and who is accountable when it does.

Gal Helemski

Aug 4, 2026

What 20 Fortune 500 IAM Leadership Titles Reveal About the Agent Authorization Gap

Identity and access management has grown up inside the Fortune 500. The function now reports through global heads, corporate vice presidents, and chiefs of staff, and it has split into specialized lanes for cloud, privileged access, and customer identity. Yet across twenty of these senior leaders, one problem fits no existing job description: deciding what an AI agent may do at the moment it acts. Gartner has named policy-driven authorization for machine actors a security priority for 2026. For CISOs and identity architects in regulated industries, the open question is who owns that decision before an agent with standing access makes it for them.

Gal Helemski

Jul 27, 2026

Runtime Authorization for Agentic AI: Fixing the Three Breakpoints in Legacy IAM

This is a webinar recap featuring Ken Huang, Co-chair, AI Safety Working Group, Cloud Security Alliance. You can watch the recording below:

Gal Helemski

Jul 22, 2026

AI Leaders We Cannot Wait to Hear at Ai4 2026

Runtime authorization sits at the center of the enterprise AI conversation, whether the conversation admits it or not.

Gal Helemski

Secure Every Identity.
Go Beyond Who Gets In.

Centralize your policy governance while distributing runtime enforcement across applications, APIs, data platforms, and agentic AI workflows.

Get a demo