top of page
Search

ARISE: Three Layers, One Platform

Ryan Rowcliffe
20 minutes ago
10 min read

Before anything about platforms, one thing needs saying, because the agentic security conversation keeps losing it.


Nothing in this threat model is new. Least privilege, credential hygiene, segmentation, inventory. Scope your service accounts. Do not bind a shared connector to a system. Verify continuously rather than at the front door. Every one of those was correct fifteen years ago, was correct ten years ago, and is correct this morning. Agents did not invent a single new defensive fundamental.


What agents did was invalidate a set of risk acceptances we had been signing off on for years. And here is the uncomfortable part: those acceptances were wrong when we signed them. We accepted an uninventoried population of service accounts because nobody had the time. We accepted static secrets in process environments because rotation was hard. We accepted over-scoped automation credentials because tightening them meant breaking something on a Friday. Each of those had a compensating control written in the margin, and if you read the margin honestly, the compensating control was almost always the same sentence: a human would probably notice.


That human was the control. It held, barely, because the adversary was also a human and therefore slow.


Underneath all of it sat one genuine gap, and it was never a missing product category. We never put the observability in place to correlate identity activity correctly, human or NHI. Not to log it, to correlate it, across the estate, into the story of what one identity is actually doing.


So when SACR defines ARISE across three layers, do not read it as three new things to buy. Read it as the bill for fifteen years of deferred maintenance, finally arriving, now that the adversary stopped being slow.


Why the three layers resist being bought separately


SACR surveyed roughly thirty vendors and sorted them into six market patterns. Identity-first runtime governance. Privileged access and secrets. Gateway and prompt control. MCP and tool governance. Runtime behavior and detection. Agent lifecycle assurance.


Six patterns is a market that has not consolidated. It is also a procurement trap, because the natural response to six patterns is to buy the best of several and wire them together. Three reasons that goes badly.


The identity model has to be shared, not translated. Layer one defines what an agent is permitted to do. Layer two decides whether current behavior deviates from that. Layer three acts. If those live in three products, an agent is three different records joined on whatever key the integration could agree on, usually a service account name or a client ID. Those keys drift. A token minted through a delegation chain frequently has no stable join key at all, which means the enforcement product is acting on an identity the behavioral product was never watching.


Decision latency compounds, and it compounds in the wrong place. Every hop between products adds time, and the hops sit between detection and action, which is precisely the interval that matters. I have watched a technically complete ARISE stack, three good products correctly integrated, produce an end-to-end intervention slower than the SOC process it was meant to replace. Nobody measured the sum. Everyone had measured their own component.


Correlation across identity types breaks at the seams. This is the one that matters most and gets discussed least. A real agent chain crosses identity classes constantly: a human approves something, an agent acts under delegated authority, that agent invokes a second agent, which presents a service account to a cloud API, which assumes a role. Five hops, three identity types. Products specialized by identity type see their own hop clearly and the chain not at all.


That last failure is the old gap wearing new clothes. We built human IAM, then bolted on machine identity, then bolted on agent identity, each with its own tooling and its own console. The correlation across them was always the missing piece, and agents are simply the first adversary fast enough to make the gap fatal rather than embarrassing.


Layer one: knowing what is actually out there


Deterministic governance is agent identity, scoped credentials, permitted tools, approved APIs, RBAC and ABAC policy, and just-in-time access. Most teams believe they have this layer because they have it for humans.


Check the belief. In our customer environments roughly 65% of the AI and automation identities we surface are unmanaged, and about half were not on the customer's inventory at all before we looked. That is not an argument for a product. It is an argument that the governance layer people think they have is governing a subset of the population, and nobody knows which subset.


Shadow agent discovery is the part of AuthMind's ARISE alignment I would lead with for that reason. Finding the copilot somebody wired into a ticketing queue, the scripted job in a business unit, the MCP server a developer stood up to save an afternoon. It is unglamorous and it is the prerequisite for every other control on this page.


The method matters here, and it is the old fundamental again. AuthMind observes identity activity across the estate, from network flows, cloud logs, IdP telemetry, and infrastructure sources, and builds the inventory from what identities actually do rather than from what a configuration file claims. Agent registries and CMDBs describe intent. Observed behavior describes reality. The gap between those two documents is where every incident I have worked lived.


With a real population established, the deterministic controls become enforceable rather than aspirational: what credential does this agent present, what is the widest thing it could reach, is that scope justified by what it has ever actually done. That last question is the one that retires over-scoped credentials, and it is only answerable if layers one and two share an observation history. A connector credential bound to system:masters that has only ever needed read access on two namespaces is not a rotation problem. It is an entitlement problem you can now see and prove.


Layer two: the correlation nobody built


This is the layer the whole series keeps returning to, because it is the genuine gap rather than a deferred fundamental.


Behavioral and intent analysis means reconstructing the path from prompt to action, instrumenting tool calls, watching credential use, scoring anomalies, and detecting drift across a sequence. Read that list and notice that every item is about a sequence. Not an event. A sequence, attributed to one identity, assembled across sources that were never designed to be joined.


Non-human identities are the easy case, which is the part that should embarrass the industry. A service account is boring and deterministic. No vacations, no laptop left in an airport lounge, no legitimate reason to behave differently in March than in February. A dataset conversion worker exists to convert datasets; the moment its service account starts enumerating RBAC and probing a public cluster endpoint, that identity has stopped doing its job and started doing someone else's. Baselining that is tractable in a way baselining humans never was. Most shops still do not bother, and it is not because the math is hard.


Two signals do most of the work, and neither is exotic.


Origin. At Hugging Face, node role credentials lifted from the metadata endpoint were replayed from external addresses on two commercial hosting providers. A credential scoped to an instance inside the VPC, presenting from somebody else's ASN. Physical security solved this problem in the nineties. The badge for the Denver office does not swipe in Frankfurt.


Reach. One auth key enrolled 181 devices with routes into CI subnets. One connector credential held cluster admin nearly everywhere it was deployed. Neither of those needed detection. They needed an inventory, built before the incident, by someone who could state what each machine identity is entitled to touch rather than what its config claims.


AuthMind's agentic identity threat detection and response works on the chain, which is the only level at which any of this resolves, and it correlates across human, non-human, and agentic identities in one model rather than three consoles joined on a name. When an agent acts under a human's delegated authority, presents a service account downstream, and assumes a cloud role two hops later, that is one story about one chain of authority. Stored as three records in three products, it is three uninteresting Tuesdays.


That is the entire argument for correlation, and it is why I keep saying the gap was never a missing detection engine.


Layer three: the verbs, and where they sit


Dynamic runtime governance is the verb list: allow, block, redact, pause, step up authentication, route to a human, reduce scope, revoke a credential, quarantine, terminate, open a ticket, escalate to the SOC. All of those operate on something in progress.


The platform argument for this layer is not that enforcement is technically hard. It is that enforcement quality is a function of what the enforcement point knows at the moment of decision. A gate that knows only the request in front of it can allow or block. A gate that knows this identity's full history, its established baseline, its delegated authority chain, and the eleven things it did in the preceding forty seconds can reduce scope, redact one field, or step up authentication instead. That is the difference between a control operations tolerates and a control operations disables.


Which is why the interesting verbs are the middle ones. Redact and scope reduction let the legitimate 95% of an action proceed while removing the part that should not happen. You cannot make that judgment from a rule table. You can make it from a behavioral model that already knows what this identity normally touches.


Now the honest part, because a post titled one platform invites a fair question about limits.


No identity platform, ours included, sits inside the model's inference loop. If an agent is manipulated by prompt injection into forming a hostile intent, the identity layer does not see the prompt. What it sees is the action that intent produces: a credential presented, a tool called, an API reached, a scope exceeded. That is the right place to intervene, and it is also a genuine boundary. Prompt-layer defenses and gateway controls are complementary work, and SACR treats them as their own market patterns for good reason.


Second limit. Enforcement requires a position in the decision path, and the path varies by environment. Where AuthMind can sit inline depends on what it fronts: identity provider integration, cloud control plane, network layer, or the tool and MCP surface. Any vendor telling you their enforcement is universal across every agent runtime in your estate is selling you a roadmap. Ask specifically which of your paths are covered on day one and which are not, and get it in writing.


Third, and this one applies to everyone in the category. Nobody has operationalized ACD 5. Autonomous policy adjustment means a system changing your controls without human approval, and the audit and rollback story has to exist before the automation does. Treat ACD 5 as a direction. Anyone selling it as a shipping feature should be asked what happens when it adjusts the wrong policy at 3 a.m.


What the deployment actually looks like


Sequencing matters more than scope, and the order is not negotiable. You cannot baseline a population you have not discovered, and you cannot enforce selectively without a baseline.


Phase

Work

What you get

Discovery

Connect identity, cloud, and network sources; surface the real population

The agent and NHI inventory, including what nobody registered

Baseline

Observe normal behavior per identity; map entitlement against actual use

Drift detection that means something, plus your over-scoped credential list

Enforce

Gate one high-value action class inline; measure latency and failure mode

ACD 4 on the thing that matters, with a defensible number

Extend

Widen action classes as operational confidence builds

Coverage, earned rather than assumed


The discovery phase is usually the one that changes the room. Teams expect to validate an inventory and instead find one they did not have. Budget for the conversation that follows, because it is a governance conversation, not a technical one, and it often reaches further up than the security org.


The baseline phase is where the old fundamentals come back and ask to be funded. You will surface static secrets in process environments, service accounts with entitlements nobody can justify, signing keys sitting in the same vault as everything else. None of that is an agentic finding. All of it is fifteen years of accepted risk becoming visible at once, and the honest framing to leadership is that agents did not create these, they just removed the compensating control we were quietly relying on.


Be realistic upstairs about the timeline. Getting static secrets out of process environments, moving to workload identity federation or SPIFFE, tiering signing keys into HSM-resident handling: in a mature estate that is quarters, not sprints. What is achievable this quarter is knowing the full list, proving the reach of each item, and gating the highest-value action class.


The enforcement phase breaks in predictable ways, and all of them are survivable if expected. Latency surprises someone. A fail-closed default takes down a batch job at 2 a.m. An agent nobody documented turns out to be load-bearing for a business process, and blocking it produces a phone call. Start with one action class specifically so these happen at a scale where they teach rather than scar.


What one platform does not solve


A single platform removes the seams between the three layers. It does not remove the work, and it does not excuse the fundamentals.


If your service accounts are over-scoped, AuthMind will show you exactly how over-scoped, with evidence, and then somebody still has to go tighten them. If your secrets sit in process environments, we will find them; the remediation is an engineering program measured in quarters. If nobody has decided which action classes always pause for a human, no product makes that decision for you. Buying the observability does not buy the hygiene, and any vendor implying otherwise is selling the same false comfort that produced the risk acceptances in the first place.


Which brings this back to where it started. SACR named AuthMind a representative vendor with broad alignment across all three ARISE layers, one of a small number among the thirteen profiled. Three weeks before that, Gartner named AuthMind a Representative Provider in its Innovation Insight on Identity Visibility and Intelligence Platforms. I am glad about both. Neither is the argument.


The argument is that we spent fifteen years accepting risks on the strength of a compensating control nobody wrote down, and the control was that a human would probably notice. That was never true enough to bet on. It is now demonstrably false, at 22 seconds per hand-off and one second to cluster admin.


The fundamentals did not change. The fundamentals never change. What changed is that the one gap we left open, correlating identity correctly across human, non-human, and agentic, stopped being a maturity item and became the thing standing between an agent's first action and its last one.


Run the seven questions from the enforcement post against us. Then run them against everyone else in the category. That is a better use of your quarter than another framework.


Sources


Gartner does not endorse any vendor, product or service depicted in its research publications. Representative Provider and representative vendor designations do not constitute endorsement.




 
 
 

Comments

bottom of page