Artificial intelligence is increasing the number of systems that can make decisions and take action without a human at every step. The collaboration between WALLIX and Inria on trusted AI is therefore relevant to a broader security shift: non-human identities are becoming operational actors, not merely technical objects. Their access, credentials and delegated authority need controls that match the speed of machine activity.
The trust problem behind autonomous action
Traditional IAM assumes that a person, application or service can be evaluated largely at the point of login. AI-enabled systems complicate that model. An agent may call several services, create temporary credentials, interpret unstructured instructions and initiate actions whose consequences extend beyond its original task. A static permission attached to the workload does not explain why the action was taken or whether its context changed.
Trusted AI approaches address the reliability of models and decisions, while NHI security addresses the identity surrounding those decisions. These disciplines overlap when an autonomous system must prove what it is, what it is allowed to do and which policy governed its action.
Why machine identity needs context
Machine identity programs have often concentrated on certificates, keys, secrets and rotation. Those controls remain essential, but agentic environments add a behavioural layer. Security teams need to connect an identity to its workload, model, owner, data sources and current task. They also need evidence that the identity is operating within an approved workflow.
This makes identity telemetry a foundation for trusted AI. If an agent suddenly accesses a new repository, invokes a privileged API or creates another machine identity, the event should be evaluated against business purpose and policy, not treated as routine automation.
From model assurance to identity assurance
Research partnerships can help organizations map trustworthy AI principles onto operational controls. In practice, that means defining clear ownership for agent identities, binding credentials to narrowly scoped workloads and recording the chain of actions that led to a decision. It also means separating the authority to recommend an action from the authority to execute it.
For CISOs, the practical priority is to make the machine identity visible across the full lifecycle. Discovery should find unmanaged agents and service accounts. Governance should establish owners, purpose and expiry. Runtime controls should limit unusual actions and require human approval for high-impact operations. These measures turn trust from a model-quality aspiration into an enforceable identity policy.