Say “trust no one” and most people hear lockdown but say “empower everyone” and they hear the floodgates opening. Put the two together and they can sound like a contradiction. The kind where security and the business pull in opposite directions, and someone has to give way.
They’re not a contradiction, but two halves of the same idea. Identity is what holds them together. This blog looks at how identity helps organisations give people and AI agents the access they need, without leaving the door open longer than necessary.
The perceived contradiction
Security leaders and business leaders often feel this tension in very practical ways. One side wants to reduce risk by tightening access. The other wants to move quickly and give people, and increasingly AI agents, the freedom to get work done.
Framed like that, every access decision becomes a negotiation. How much safety are we willing to trade for speed? How much friction can the business tolerate? How much risk can security live with?
That framing is the problem. “Trust no one” does not mean withholding access. It means never granting access on assumption. “Empower everyone” does not mean open access. It means giving each identity exactly what it needs, when it needs it, for as long as it needs it.
In practice, both ideas are required and identity is what makes them work together.
You can only empower confidently when you can verify precisely.
Why traditional access models fall short
Security and speed felt like a trade-off for a long time because traditional access models often could not deliver both. Access was usually built around roles, static permissions and network location. You were inside the network or outside it. You held a role or you did not. The permissions attached to that role tended to stay in place until someone remembered to change them.
That model has familiar failure points. To avoid slowing people down, administrators over-provision access, more than the task requires, just in case. Because revoking access creates work, permissions often remain long after the need has passed. Because access grants are broad and static, few organisations have a clear, current view of who can reach what.
The result is an environment that quietly accumulates standing access that no longer maps to real need. Traditional models optimise for convenience. Unfortunately, convenience has tended to bring with it over-permissioning, poor visibility and a backlog nobody is especially keen to own.
The result is neither strong security nor real agility.
The zero trust shift
Zero trust means access is checked every time. No user, device or agent is trusted automatically, even if they had access before.
Access is no longer assumed at the front door and kept indefinitely. It is evaluated at the point of use, every time, against the full picture.
Those decisions rest on three inputs.
- Identity: who or what is asking?
- Context: what device, location, behaviour and task are involved?
- Risk: how sensitive is the resource, and does anything look unusual right now?
Microsoft describes this as access that continuously re-evaluates trust across both authentication and network layers. The goal is to make real-time, risk-based decisions that go well beyond the first sign-in.The shift is subtle, but significant. Access becomes dynamic, not permanent
Identity as the enabler, not the blocker
This is where the narrative changes. When access is evaluated dynamically against identity, context and risk, identity stops being the thing that only says “no”. It becomes the thing that helps you say “yes” safely.
Strong identity controls support precise access decisions, context-aware policies and real-time enforcement. And precision is what removes unnecessary friction. Instead of applying broad restrictions to everyone because of the riskiest possible case, you can grant exactly what a specific identity needs in a specific moment. That means less standing access to manage, fewer blanket blocks and more safe autonomy for people and agents.
Microsoft frames the goal in a similar way: employees should be able to get value from powerful productivity tools while being protected from new risks. Modern controls, including approaches such as passkeys, are designed to balance strong security with a fast, familiar experience, rather than forcing organisations to choose one over the other.
The better your identity controls, the more confidently you can enable access. Control and empowerment do not have to pull against each other. With the right identity foundations, they move in the same direction.
Controlled access in practice
In practice, controlled access is less about saying no and more about being precise.
- Access is granted just in time, provided for the duration of a specific task, not as a permanent entitlement.
- Access is scoped to least privilege. Each identity gets the minimum needed to do the job, with elevation only when explicitly required.
- Access is based on context. Device, location, behaviour and current risk all help determine whether access is allowed, and how much access is appropriate.
Just as importantly, access is removed. It’s removed when the task is complete. When the need no longer exists. When the risk picture changes.
This applies across every kind of identity in the environment: human users, non-human identities such as service accounts, and AI agents.
The same just-in-time, least-privilege, context-aware logic that protects an employee should also govern an agent acting on that employee’s behalf. Otherwise, organisations risk applying strong controls to people while leaving the most powerful non-human identities to wander around with access they no longer need.
What organisations often get wrong
The mistakes are consistent, and they usually come from treating control and empowerment as opposites. Some organisations treat control as restriction where every access policy is seen as a brake on productivity, rather than the thing that makes confident productivity possible. Some prioritise speed over governance. Tools and agents are rolled out first, with controls planned for “later”. Later then arrives with standing access, shadow usage and a few surprises nobody ordered. Some assume access is safe once granted. A permission is treated as permanent, even though context and risk change constantly. Some ignore non-human identities. Human users are governed carefully, while service accounts and agents, often among the most over-permissioned actors in the estate, are left with far less oversight.
The common thread is simple: without strong identity, empowerment becomes unmanaged risk.
What good looks like
The target state is easy enough to describe. Operating it takes discipline. Every identity is known, verified and governed. There are no anonymous or unowned identities with access to systems or data that matter. Every access decision is explicit, context-aware and continuously enforced. Nothing is granted on assumption, and nothing is assumed to stay valid forever.
Done well, this creates a practical balance between three things organisations often feel forced to choose between.
- Security: access is tightly controlled and continuously verified.
- Usability: controls are precise enough that legitimate work is not obstructed.
- Scalability: the model holds as identities multiply, including the fast-growing population of agents.
The point of good identity is not to maximise one of these at the expense of the others. It’s to make all three achievable at once, that’s the real value. Not more control for its own sake but better control, so the organisation can move without constantly looking over its shoulder.
From control to confidence
For anyone weighing security against speed, the conclusion is straightforward. Organisations do not need less control. They need better control.
Better control converts caution into confidence. When you can verify every identity, scope every grant and re-evaluate every decision in context, you can do things that would otherwise carry too much risk. You can place agents into sensitive environments. You can expand use cases. You can move quickly without falling into the familiar cycle of incident, fix, retrofit and repeat.
The evidence supports this. When JPMorgan Chase deployed an in-house AI platform to more than 200,000 employees in eight months, it did so by connecting existing identity controls into the platform from day one. Governance did not slow adoption, it made adoption possible at that scale and pace.
Microsoft makes the same point at a strategic level. Get the identity foundation right, and organisations gain the resilience to move quickly without unnecessary compromise. They can embrace AI with confidence rather than holding back because they cannot see or control the risks.
Make access easier to govern
Controlled access depends on identity controls that are clear, current and built around real business need. Through our identity and access management services, CWSI helps organisations understand where access is too broad, where governance is too static, and where human and non-human identities need closer oversight.
The aim is simple enough, give people and AI agents the access they need, when they need it.
