# Non-human and AI agent identity: podcast learning path

Source: https://startwithidentity.com/podcasts/learn/non-human-identity/

Service accounts, secrets, workload identity, and the newer problem of giving AI agents scoped, auditable access. 14 episodes, ordered from basics to advanced.

Read alongside: [Non-human identity (glossary)](https://startwithidentity.com/glossary/nhi/), [What is non-human identity?](https://startwithidentity.com/guides/fundamentals/what-is-non-human-identity/), [Agentic identity (glossary)](https://startwithidentity.com/glossary/agentic-identity/), [Securing AI agent identities](https://startwithidentity.com/guides/machine-identity/securing-ai-agent-identities/), [Workload identity federation](https://startwithidentity.com/glossary/workload-identity-federation/), [SPIFFE (glossary)](https://startwithidentity.com/glossary/spiffe/), [The best episodes on non-human and agentic AI identity](https://startwithidentity.com/articles/best-podcast-episodes-non-human-agentic-ai-identity/)

1. [Analyst Chat #234: Identity Management in a World of Automated Systems - Machine Identities](https://www.kuppingercole.com/watch/automated-systems-machine-identities) (KuppingerCole Analyst Chat, 2024-10-21, 21 min, learner): Why 'machine identity' is a loose label for devices, services, and workloads, and why their scale requires automated lifecycle and secrets management, with regulation still catching up.
2. [#365 - Exploring the Future of Machine Identity with Felix Gaehtgens](https://podcasts.apple.com/us/podcast/365-exploring-the-future-of-machine-identity/id1471899975?i=1000720573614) (Identity at the Center, 2025-08-04, 62 min, learner): How machine identities differ from human ones, why static credentials like API keys and service accounts create technical debt, and the case for dynamic, ephemeral credentials.
3. [401 Access Denied Podcast Ep. 76 | Discovering and Stealing Secrets with Mackenzie Jackson](https://podcasts.apple.com/us/podcast/401-access-denied-podcast-ep-76-discovering-and/id1485295700?i=1000605272827) (401 Access Denied, 2023-03-22, 33 min, practitioner): The main ways attackers find and exploit secrets and credentials leaked in source code, and how developers can defend against those attacks.
4. [Shadow Admins: The Non-Human Identities Hiding in Your Entra Tenant](https://entra.news/p/shadow-admins-the-non-human-identities) (Entra.Chat, 2026-06-20, 69 min, practitioner): How service principals, app registrations, and agent identities become hidden admins, which API permissions to hunt for, and why to replace secrets with managed identities.
5. [Analyst Chat #264: Persistent Identity, Ephemeral Secrets - Workload Identities in the Age of AI](https://www.kuppingercole.com/watch/persistent-identity-ephemeral-secrets) (KuppingerCole Analyst Chat, 2025-08-11, 22 min, practitioner): Why workload identities should be treated as privileged, how long-lived secrets widen the attack surface, and how ephemeral secrets, SPIFFE/SPIRE, and policy-as-code help.
6. [Root Causes 640: What is SPIFFE?](https://www.sectigo.com/root-causes/root-causes-640-what-is-spiffe) (Root Causes: A PKI and Security Podcast, 2026-07-15, practitioner): What SPIFFE is, how it places a workload or AI agent identifier inside a certificate, and how policy engines can allow-list those identifiers.
7. [The Co-Inventor of Tor on Why Your NHI Strategy Is Already Behind](https://podcasts.apple.com/us/podcast/the-co-inventor-of-tor-on-why-your-nhi-strategy/id1683228982?i=1000769664864) (The Identity Jedi Show, 2026-05-26, 63 min, practitioner): Why non-human identity risk built up while human identity matured, covering service accounts, unrotated API keys, hardcoded credentials, and zero trust for AI agents.
8. [45. What's the magic of OIDC identity providers?](https://awsbites.com/45-what-s-the-magic-of-oidc-identity-providers/) (AWS Bites, 2022-07-15, 27 min, practitioner): How GitHub Actions gets short-lived AWS credentials without stored keys: OIDC provider setup, role trust policy conditions on aud and sub claims, JWT signing, and AssumeRoleWithWebIdentity.
9. [Securing Non-Human Identities in the Age of Agentic AI with Sarah Cecchetti, Director of Product Management at Semperis](https://www.hipconf.com/podcast/securing-non-human-identities-agentic-ai-sarah-cecchetti/) (Hybrid Identity Protection Podcast, 2026-04-28, 43 min, architect): Where authentication and authorization standards fall short for non-human identities and AI agents, and which emerging frameworks and external guardrails aim to close the gap.
10. [#390 - Identity Management for Agentic AI with Tobin South](https://podcasts.apple.com/us/podcast/390-identity-management-for-agentic-ai-with-tobin-south/id1471899975?i=1000740200992) (Identity at the Center, 2025-12-08, 56 min, architect): Identity challenges raised by AI agents, the role of MCP, and recursive delegation and scope attenuation, drawing on the OpenID Foundation agentic AI whitepaper.
11. [Agentic AI and the Authorization Gap No One Closed with Geoffrey Mattson, CEO of SecureAuth](https://www.hipconf.com/podcast/agentic-ai-authorization-gap-geoffrey-mattson/) (Hybrid Identity Protection Podcast, 2026-06-09, 35 min, architect): Why AI agents need each action authorized in real time, why few MCP servers implement the OAuth the MCP spec requires, and how to roll agents out from zero privileges.
12. [#422 - Decoded - Securing AI Agents with Standards You Already Have](https://creators.spotify.com/pod/profile/identity-at-the-center/episodes/422---Decoded---Securing-AI-Agents-with-Standards-You-Already-Have-e3j8ncb) (Identity at the Center, 2026-05-15, 78 min, architect): How existing OAuth specifications such as JWT authorization grant, token exchange, and client ID metadata, plus SPIFFE, apply to securing AI agents as workloads.
13. [Analyst Chat #317: MCP Is Just Another API, and That's the Bad News](https://www.kuppingercole.com/watch/mcp-just-another-api) (KuppingerCole Analyst Chat, 2026-09-29, 52 min, architect): Why MCP security is an API, identity, and authorization problem, covering unauthenticated MCP servers, tool poisoning, prompt injection, and practical next steps.
14. [One Compromised Agent ID Blueprint Can Cross Tenant Boundaries](https://entra.news/p/one-compromised-agent-id-blueprint) (Entra.Chat, 2026-07-12, 54 min, architect): How Entra Agent ID blueprints, agent identities, and agent users relate, and how stolen blueprint credentials could reach agent identities in other tenants.