AI Security
Okta extends AI agent governance into FedRAMP-certified environments
The identity platform has made its AI agent lifecycle management tool available in regulated federal and healthcare settings, treating agents as managed identities rather than static credentials.
The New Stack
Okta has released Okta for AI Agents – Core as generally available in FedRAMP- and HIPAA-regulated environments, marking what the company says is the first time an independent identity platform has extended AI agent management into these compliance frameworks that federal agencies and healthcare organizations already operate within.
The shift reflects mounting pressure on government to adopt AI systems while maintaining security controls. A recent executive order on AI directs federal agencies to deploy agents while ensuring they remain secure—a directive that creates a fundamental tension between speed and risk management.
Treating agents as managed identities#
Rather than managing AI agents as static service accounts or hardcoded API keys, Okta's approach elevates them to first-class identities tracked within the same governance framework used for human and machine workloads. According to Amy Johanek, Okta's VP of Federal, agencies receive a consistent message: "Adopt AI aggressively, but secure it as you go."
The problem Okta is addressing is visibility. AI agents remain "the fastest-growing class of non-human identity yet, and the hardest to see." Anyone can instantiate new agents, which can spawn additional agents, and each one connects across multiple applications, APIs, SaaS platforms, MCP servers, and data systems with minimal oversight—creating what the company characterizes as unguarded doors within security architecture.
Four governance risks in ungoverned agents#
Okta identifies four specific risks for organizations running unmanaged AI agents:
- Compliance violations: Agents may access data beyond authorized boundaries
- Compounding breach risk: A compromised agent credential can grant access across all systems an agent can reach before human intervention occurs
- Failed audits: Agents operate as orphaned accounts with no clear owner or activity trail
- Slowed AI adoption: Uncertainty forces organizations to delay deployments for safety
How the platform works#
The governance model centers on three core questions: where agents operate, which resources they can access, and what actions they're authorized to perform. Agents are registered within Okta's Universal Directory as named, owned identities—whether built internally or acquired from third parties.
