Notifications
Clear all
Topic starter
12/06/2026 9:29 pm
TL;DR: AI-powered IT Superstore inside SalaX Secure Messaging automates phone and headset ordering through an AI agent, API integrations, and approval steps, showing how conversational workflows can run real enterprise processes end to end, according to SSH Communications Security. The governance problem is not the chat interface, but the delegated identity and policy assumptions that let the agent act across systems without human bottlenecks.
NHIMG editorial — based on content published by SSH Communications Security: the AI-powered IT Superstore built inside SalaX Secure Messaging
Questions worth separating out
Q: How should security teams govern AI agents that can place orders or update records?
A: Treat the agent as a governed non-human identity with named ownership, scoped entitlements, and explicit approval points.
Q: Why do conversational workflows create new identity governance risk?
A: Because they make delegated access feel lightweight while still enabling real system actions.
Q: What breaks when an AI agent can act across multiple business systems?
A: Traditional helpdesk controls break because they assume a human can be held at the centre of the workflow.
Practitioner guidance
- Inventory conversational agents as production identities Create a register for every chat-based workflow that can trigger external actions, including owner, scope, integrated systems, and revocation path.
- Separate eligibility checks from execution rights Keep business-rule evaluation, user approval, and downstream API execution as distinct control points.
- Bind secrets to each integration path Issue separate credentials for order placement, HR notification, and IT notification so compromise of one integration does not expose the full workflow.
What's in the full article
SSH Communications Security's full article covers the operational detail this post intentionally leaves for the source:
- The end-to-end build pattern for the SalaX Secure Messaging workflow, including how the agent is connected to the order and notification systems.
- The specific internal process rules used to decide when a device is eligible for renewal and what happens after the user approves the purchase.
- The implementation stack behind the production deployment, including the codebase, container packaging, and version-control approach.
- The practical messaging workflow that employees use to request a replacement phone or headset inside the secure chat interface.
👉 Read SSH Communications Security's analysis of the AI-powered IT Superstore workflow →
AI-powered IT superstores: what it means for agent governance?
Explore further
12/06/2026 11:36 pm
AI-powered business workflows are really identity workflows in disguise: the visible product is a conversational interface, but the security reality is a delegated machine identity executing business logic across systems. That means the control boundary shifts from ticket handling to entitlement design, auditability, and lifecycle ownership. Practitioners should stop evaluating these systems as chat features and start evaluating them as governed non-human identities.
A few things that frame the scale:
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: Who is accountable when an AI agent makes an incorrect business decision?
A: Accountability sits with the teams that defined the rules, assigned the credentials, and approved the integration. The agent does not remove ownership, it concentrates it. Governance should make the responsible system owner, approval record, and revocation path easy to identify before the workflow reaches production.
👉 Read our full editorial: AI-powered IT superstores change how agent identities are governed
