Howard Ting, CEO of Opal Security, joins Jeff Steadman for a Sponsor Spotlight covering identity governance for both human and non-human identities. Howard traces his path through RSA Security, Microsoft, Palo Alto Networks, Nutanix, and Cyberhaven before returning to identity to lead Opal. The conversation covers why disabling a departing employee's account rarely ends their access, the orphaned tokens, service accounts, and agents left behind, and why visibility has to come before ownership and risk analysis. Howard and Jeff dig into agent intent and authority: whether an agent can declare its own intent, why permissions should stay a subset of what its human creator holds, and how narrowly scoped, single-task agents make governance easier. They also cover how Opal matches AI decision capacity to a growing volume of access requests, including how the company's Paladin AI supports approvers and campaign creators today. The episode closes with Opal's announcement of a unified platform for governing human, non-human, and agent identities together, extending Paladin's decisioning to agents and introducing Policy Insights to help security teams balance friction against risk. Howard shares his view that identity has to shift from an episodic, event-driven practice to a continuous one, along with a lighthearted detour into 90s video games.
Connect with Howard: https://www.linkedin.com/in/howardting/
Learn more about Opal Security: https://www.opal.dev/
Connect with us on LinkedIn:
Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/
Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/
Visit the show on the web at idacpodcast.com
00:10 Intro and welcome
01:01 Howard's identity origin story: RSA, Microsoft, Kim Cameron
02:48 What Opal does: unified control plane for human and non-human identities
04:16 The opal.dev domain and how Opal got its name
06:42 Termination and lifecycle: why access doesn't fully go away
09:33 Session management and orphaned accounts
13:57 Visibility as the first step in identity governance
17:31 Can an agent declare its own intent?
20:29 Authority: should an agent ever exceed its creator's permissions?
22:12 Inside Opal: Risk Center and Policy Insights
25:41 How Opal connects to systems and collects usage data
27:30 Cross-application segregation of duties
29:06 Zero standing privilege and AI managing AI
32:12 Building trust in AI-driven access decisions
39:00 Announcing Opal's unified platform for agents and non-human identities
44:18 Explainability and traceability in Paladin's decisions
48:54 Tuning risk tolerance and autonomy in Paladin
51:20 Proving value: demos, POCs, and industry skepticism
57:47 The shift from episodic to continuous identity
59:50 Lightning round: favorite 90s video games
IDAC, Identity at the Center, Jeff Steadman, Jim McDonald, Howard Ting, Opal Security, Sponsor Spotlight, identity governance administration, IGA, non-human identity, NHI, agent identity, agentic AI, access governance, least privilege, just-in-time access, JIT, zero standing privilege, Paladin, Risk Center, Policy Insights, segregation of duties, SOD, RSA Security, Microsoft, Kim Cameron, Palo Alto Networks, Nutanix, Cyberhaven, continuous identity, identity lifecycle management, orphaned accounts, service accounts, API keys, intent-based access control
1:16:04