Saviynt Extends Identity Security Into AI Agent Activity

Saviynt has launched Zuma, an enterprise AI identity security platform for governing AI agents and other non-human identities. The platform extends identity controls into the actions agents take while they are operating, rather than relying only on permissions assigned before they begin work.

“AI is fundamentally changing the identity security equation,” said Sachin Nayyar, CEO of Saviynt. “Enterprises are no longer securing only human users. They are now responsible for AI agents and non-human identities that can decide and access systems at machine speed.”

Zuma is designed for that broader identity surface. It maintains ownership for each AI identity and evaluates actions at runtime, using the agent’s intent, identity, context, and risk to determine whether a request fits its assigned task.

AI Agents Expose the Limits of Static Access Models

Identity governance establishes which resources an identity can access and whether those permissions remain appropriate over time.

AI agents complicate established identity models because they can act autonomously and perform tasks across multiple systems on behalf of people or business processes.

An access role may define what an agent is allowed to reach, but it does not always establish whether a specific action fits the task it was assigned or who remains accountable when that action exceeds its intended scope.

For example, an agent may act independently or on behalf of a person, move between applications and tools, and execute a sensitive operation without a new human request at each step. Saviynt says that authentication, authorization, and attribution should continue while the agent is working, not end when access is granted.

Visibility and ownership create a related challenge. An organization cannot apply policy to an agent it has not identified, and accountability can lapse when an agent remains active after its creator changes roles or its original purpose ends.

Governing these identities requires continuous oversight throughout their lifecycle.

Zuma Brings Discovery, Access, and Governance Together

Saviynt organizes Zuma around three connected functions.

Zuma Insights identifies AI agents and other non-human identities, maps their access, and shows where they could create risk. It also records agent activity and identity changes to support investigations and audits.

Zuma Access applies policy while an agent is working. It uses information about the agent, its assigned task, and current risk to determine whether an action should proceed.

Zuma Governance manages each agent from registration through retirement. It assigns ownership, supports access requests and reviews, and keeps accountability current as teams and responsibilities change. A kill switch allows organizations to disable or remove unmanaged and orphaned agents when they no longer have an owner or business purpose.

The three functions depend on one another. Insights supplies identity and risk information, Governance maintains ownership and lifecycle controls, and Access uses that context to evaluate actions at runtime.

Runtime Authorization Completes the Zuma Control Plane

Zuma Access is the most distinct part of the platform. Traditional authorization determines whether an identity has permission to perform an action. Zuma Access also evaluates the agent’s intent, identity, context, and risk while the request is being made.

As Zuma’s runtime control layer, Access works alongside Insights and Governance. It first establishes whether an agent is acting independently or on behalf of a person, then applies policy to the requested action. Fine-grained controls can separate routine activity, such as viewing information, from sensitive operations that require tighter oversight.

Saviynt says Zuma can block anomalous or harmful actions before they affect the business. That moves identity security into the agent’s execution path, where policy can respond to the task underway rather than relying only on access approved earlier.

Within Saviynt’s broader portfolio, Zuma extends the company’s cloud identity platform into agent activity. Its runtime controls work alongside posture management, identity governance, privileged access management, and fine-grained entitlement controls.

This places agent discovery, lifecycle governance, privileged access, and runtime authorization within the same service.

What This Means for SAPinsiders

• Runtime authorization gives identity teams a stronger operating role. Evaluating policy during execution lets identity controls support business processes, not only access decisions. Organizations can connect security requirements with how automated work is actually performed.
• Better policy inputs improve agent decisions. Clear task definitions, ownership data, and risk signals give runtime controls useful context. Strengthening those inputs can help enterprises scale agent activity without relying on broad, static permissions.
• Shared ownership keeps agents aligned with business purpose. Assigning business and technical owners gives each agent a clear sponsor throughout its lifecycle. That structure helps teams update access and retire agents when their purpose changes.