Okta's Oktane 2025 | Shiv Ramji, Okta

Clips
More from Okta's Oktane 2025

Shiv Ramji

President of Auth0

Okta

play_circle_outline Transforming App Development: The Impact of Generative AI and Identity Challenges in the Evolving Tech Landscape

play_circle_outline Developers must make applications AI-ready with increased security and access controls.

play_circle_outline Security concerns have risen with the proliferation of AI-driven applications and tools.

play_circle_outline Enhancing User Experience: The Vital Role of AI in Flexible Consent Management and Identity Verification Security

Info
Transcript

Shiv Ramji, Okta

Shiv Ramji

President of Auth0 Okta

Shiv Ramji, president of Auth0 at Okta, joins theCUBE’s Rebecca Knight and analyst Jackie McGuire to discuss how AI reshapes app design. Ramji explains why conversational, nondeterministic apps shift the access point to the presentation layer. Identity becomes the control plane for AI agents and zero trust, he suggests. The discussion covers how Auth0 serves builders with a standards-first approach for agents, APIs and session security. Apps become “fabric-ready,” so IT gains protection without extra configuration. Access maps to user permissions, not just th... Read more

explore Keep Exploring

What fundamental changes are occurring in application development for developers due to the influence of AI? add

What are the key considerations for integrating AI into products and addressing the associated security concerns? add

What are the current security concerns related to chatbots and data leakage, and how do they impact clients like developers and engineers at Auth0? add

What are some important considerations and challenges related to consent, permissions, data security, and identity verification in the context of AI? add

bolt Powered by CUBE AI

Shiv Ramji, Okta

search

Rebecca Knight

>> Hi, everyone. Welcome back to theCUBE's live coverage of Okta Oktane here in Las Vegas. I'm your host, Rebecca Knight, alongside Jackie McGuire, my co-host and analyst. This is your jam. Authentication, you love this stuff.

Jackie McGuire

>> I've been writing about identity for a handful of months pretty hardcore, so I have to admit I'm in a nerd's paradise.

Rebecca Knight

>> All right. Well, welcome to nerd's paradise and welcome to our next guest, Shiv Ramji, president of Auth0 at Okta.

Shiv Ramji

>> Thank you.

Rebecca Knight

>> Thank you so much for coming on the show.

Shiv Ramji

>> Appreciate it.

Rebecca Knight

>> Let's do a big picture setup for our viewers. You have said that AI isn't just changing what we build, but also how we build. Talk a little bit about that and what feels fundamentally different for developers right now.

Shiv Ramji

>> Yeah, so when we say AI is changing what we build and how we build, what we mean is so today when you build applications, they're very deterministic. I'll just give you an example because we all travel. So say for instance, you use the American Airlines app to travel here. What you can do once you log in inside the application, it's finite, it's predetermined. And so you are always going to go down known paths, and that's how you control access to data. So that's your control point. When you enter the world of AI, especially when AI is conversational, it's nondeterministic, it can do long running tasks, it can work in the background, and frankly it can take any input because it's just natural language. So that very nature of how AI applications are built or what generative AI and agents can do, you have to rethink how you build your applications because you can no longer control the access point inside your application. In fact, I bet you a year from now when you use the American Airlines application and if it has a natural language interface to it, it's going to look very different and you'll be able to do a whole lot more things than what you can do today. So the implication here is your typical three tier architecture, where you kind of have the data layer, your business logic, and presentation, changes fundamentally. And what happens is your presentation layer is now the access point. So that's a pretty big change in how applications basically are going to be built. Then about what's changing with what you build, lots of differences there too. So for example, now the new mandate for everybody is like you are trying to bring AI into your product. And it's not just some feature, but it's really about an internal, it might be an internal copilot, might be a smarter workflow, or might be a chatbot. So you're trying to bring AI into the product. And the second thing is you have to now make your products AI ready. And what I mean by that is now your products have to talk to other agents, other systems, other APIs. Well, that's a whole new set of security concerns. And so those are the two big things. If you're a builder of applications now, when you think of these two trends, it's like, wow, that's a pretty big shift. And so now your security concerns, your security perimeter has changed drastically. And I think the proof of what's happening here is in all the headlines, if you look at the last few months when you've heard of chatbots going rogue and having access to information, data leakage. So I think these concerns are no longer hypothetical, this is happening now and we're already experiencing it.

Jackie McGuire

>> So with Auth0, generally your clientele has been developers and engineers, so generally the people behind the scenes who are building the apps. And now I think with generative AI and with things like Claude and the ability for normal people to build these things, how do you view... Because I think one of the things we were all thinking about when Okta acquired Auth0 is these are two very different customer bases., But now it seems like AI is enabling them to merge cross over. So how do you think about that in the sense of Okta's always been this great platform for being able to sign in once, get access to all your work apps, and so how do you bring that cross app access and things like that, how do you think about the merger between the Okta interface and the Auth0 interface?

Shiv Ramji

>> Yeah, I think the beauty about this new world is, and kind of how we serve them is we're really focused on builders. And so we are doing everything we can to give builders everything they need from a standards first perspective. So if you're an engineer developer and you've built your application or AI agent or chatbot, whatever it is that you're building, if it's built with Auth0, you're going to get all of these standards out of the box. And then if that application is now being consumed within the boundaries of an enterprise or a company, and if you're using Okta to manage access to your employees and in terms of applications they can access, now you already have all of the security standards and capabilities built in. So there is no further configuration required. You don't have to change your applications. IT teams don't have to go do five other things. They're like, oh, this application's, we say these apps are going to be fabric-ready. What we mean by that is they come with standards. And so when you are now in the hands of an IT admin who's trying to configure these applications, they know that they're going to get the full security benefit in terms of session protection or really all of the identity threats that you have, they can protect against them.

Jackie McGuire

>> So rather than at the Auth0 level, having to figure out what level of access that this app should have to Salesforce and to your HR platform, you can basically map that access to the user and make sure that no user can use an agent to do something that they wouldn't have been able to do on their own. Correct?

Shiv Ramji

>> I think you just nailed it. Yeah. So we did two things. One, through the Auth0 platform, we allow you to make it easy for builders to connect their agents to other applications. But once you as a user, if you're using that agent, you can only get to access to specific resources in that app based on your permissions. So there are two parts here. One is just connecting the agent to the app, then what can you have access to through that agent inside the app, and that's truly determined by what your permissions are.

Rebecca Knight

>> So one of the things that Todd McKinnon talked about on the main stage today was this tension that frankly leaders like he feels, but also leaders of teams and smaller teams, that to be innovative but also to be secure. He said something like, "If I'm not building a trillion dollar AI company, what am I doing with my life?" And I feel like a lot of us, a lot of us feel that.

Shiv Ramji

>> Feel that way. Yeah.

Rebecca Knight

>> So how do you manage that tension within your team?

Shiv Ramji

>> I mean, everything that we are doing, so we do lots of experiments and labs and tests, these are not production environments, so we learn in those environments. And we have to keep up, especially my team and my organization, we have to keep up with everything that's going on with AI. And there is a breakthrough of some sort almost every week. And that's kind of what we saw last year when this generative AI experiences were coming out. We were the first to spot that, wow, security is actually going to be a problem. So we actually announced a developer preview last year and said, hey, talking to all the users and customers, there are four requirements that are critical for agents to work successfully. And so we put our product out in developer preview and it's been a good place to learn and talk to real enterprises, real use cases, and we have seen some of those use cases develop. And once we validate, that's when we bring these products to market. So that's one. The second thing we do is we also use our own products internally. So all of the apps that we're building, that Oktane registration, for example, is built using Okta. We have internal initiatives where we're using our own fine-grained authorization product to solve the data governance problem. So we use these products ourselves to first understand are we solving the needs, are there unintended consequences, before we take these out to market. And so that's a way to kind of mitigate this notion of we can innovate, learn within our own labs, and we're not putting something out there too quickly. And then also we incubate a lot of these products through our beta periods and early access periods and developer preview, which we did in this case to make sure that what we are building kind of meets the need of a really rapidly evolving market.

Rebecca Knight

>> Well, can you talk a little bit about those use cases and how developers are using these identity fundamentals to build apps in healthcare or finance?

Shiv Ramji

>> Yeah. So there are four key requirements across all of these industries that kind of are common. So first is very basic, just like you have to authenticate and validate who you are. We have to do that for agents. But there is something unique here. We need to make sure that not only is the agent authenticated, but the agent is authenticated on behalf of you. So that linkage is super important. Then the second thing is I talked about how these agents have to connect to different applications, and depending on use case, an agent will have to connect to 30, 40, 50 different applications securely. And that's really burdensome for builders and developers. So what they have told us is there is no way I can go configure each and one of these connections for every single agent that I'm building. There's got to be a better way. So agents need to talk to different applications via APIs, and you need to do that securely. So that's kind of the second requirement. The third requirement is while agents are powerful and we want them to do all kinds of stuff for us, there are sensitive transactions. A good example would be if an agent is making a purchase on your behalf, I think you may want to be in the loop to say is this amount right and are you purchasing the right thing. Or maybe if you ask an agent to go build you a travel itinerary where you're going to spend thousands of dollars and your family's traveling with you, you probably want to review that before the agent makes a purchase. So we believe right now, at least in this stage of the evolution, our customers and the agents they're building, they will need human intervention or human verification. So we call this human in the loop. And the last thing is all about data security and permissioning. I had mentioned how the way apps are being built are changing. You have a lot more surface here that is exposed to attacks. Your data, your APIs are now exposed. So how do you control access to that? You need finer-grained permissioning. So these are the four requirements that are fairly common across all industries and across most agentic use cases. So the product that we've built is really addressing these four key requirements, and then obviously we'll learn from that and continue to build on top of that.

Jackie McGuire

>> One of the things you talked about yesterday in the analyst sessions and we've heard quite a bit from a lot of the leadership both at Auth0 and Okta is this concept of building frameworks and kind of trying to lead the way in terms of that. Because it seems like, I know I as a early data scientist, I was making all of these hard-coded token mistakes and things like that. I just didn't know better. And at the time, there really wasn't a framework or guidance or anything like that to tell me how to do better. So can you talk a little bit about that and about why Okta's chosen to get deeply involved in this framework and guidance process?

Shiv Ramji

>> Yeah, there are two parts to this. So the first one is the investments we're making in standards with many others in the industry. We're not the only ones. But we certainly care about it a lot because of security outcomes. So that is one big investment. The second investment is, look, builders and engineers and developers, they are not security experts, and I don't think it's fair for us to expect them to be. So this is where the capabilities that we're building, we're taking that burden away. So we are identity experts, we know how to secure tokens, vault them and scope them. So we're going to take that burden, and then we make it really easy for a developer to use our products and APIs so they don't have to think about leaking credentials, storing tokens in clear text in their code. We take away that burden. And so those are the two ways we're making it really easy so that developers want to build value and they want to build the next cool thing and innovation, we don't need them to be security experts.

Rebecca Knight

>> So finally as we wrap up, how do you see the relationship between AI and identity evolving in terms of what the developer of tomorrow needs to know that the developer of today, it might not be as important?

Shiv Ramji

>> So these are my prediction and futurecasting a little bit. I don't know which ones will be accurate. But I can imagine today I talked about these four key requirements and kind of the products we're launching. One interesting bit in there is consent. And I think you will see when we do our demos, when we talk about our products, you'll see a lot of consent screens like, yes, I allow you to do that or I allow this app to access information. I think we'll have to solve the consent problem. So when you think of AI and identity, I think consent is something that we have to think about solving. It's not just a security thing. It's also a very annoying end user thing. I mean, imagine we already complain about those GDPR cookie boxes, don't we? Right?

Jackie McGuire

>> Yeah.

Shiv Ramji

>> It's annoying, right? Imagine you had to do that 70 times in a day for every single app and interaction.

Rebecca Knight

>> Feels like I already do.

Jackie McGuire

>> But on the other though, so there was a demo you showed yesterday where it was like, oh, you don't have access to this thing. Let me request it from your manager. And I was like, no, I don't want my manager to know.

Shiv Ramji

>> Exactly, yeah.

Jackie McGuire

>> So maybe the user needs to be able to tweak that consent a little bit.

Shiv Ramji

>> That's also true. You will need flexibility with how you present the consent. So I think there is a user experience component. So I think consent is a category that's really interesting. Another category that I think about, we are thinking about permissions. So I think data security is a really hairy problem here that I think when you think of AI and identity, I think identity will play a role in that. Third would be it's really hard for humans to distinguish what is AI versus human. And you would think, well, machines are good at it. They're having a hard time too. So I think how do you verify that someone is who they say they are? So identity verification is going to be a very interesting problem. It's already a problem now because you can see all kinds of problems such as fraud, that product fraud and product abuse that you're seeing. So I think that's going to be an interesting area I think we will have to solve for that. And then the last one, which is really going out there, is that all of these AI tools are essentially building memory. If you're using ChatGPT or using Perplexity, they have the history of all the questions you've asked. Well, I know all of us are using different tools. It's going to be annoying if you have to go to every new tool and share all the research, all the questions you've asked. So I think at some point, memory will need to be portable and it's going to be linked to your identity. So those are kind of some of the areas that I think we will see an evolution in some way. And my bet is identity will have a role in it.

Rebecca Knight

>> Well, we are going to check your work when we're back here at Okta Oktane 2026.

Shiv Ramji

>> Exactly, exactly.

Rebecca Knight

>> So Shiv, thank you so much for coming on the show.

Shiv Ramji

>> Thank you.

Jackie McGuire

>> Thank you.

Rebecca Knight

>> I'm Rebecca Knight for Jackie McGuire. Stay tuned for more of theCUBE's live coverage of Okta Oktane. You're watching theCUBE, the leader in enterprise tech news and analysis.