Topic starter
24/06/2026 9:14 pm
TL;DR: AI workloads, workload identity, and policy-driven authorization converged around one problem at KubeCon Europe 2025, according to Cerbos. Cloud-native platforms now need traceable identities and runtime guardrails before services or agents can act.
Editorial analysis by NHI Mgmt Group, based on content published by Cerbos: “Insights from KubeCon Europe 2025 - AI gets real, and identity gets serious”.
Key questions
Q: Why do shared credentials and hardcoded RBAC become a problem in cloud-native systems?
A: They hide who is actually acting and make access decisions brittle when systems scale or change dynamically.
A: A tightly coupled model usually shows up when small policy changes require code changes, deployments, or manual edits across multiple services.
Q: How should security teams preserve workload identity in Kubernetes monitoring setups?
A: Use persistent storage for registration state, stable naming through StatefulSets, and a deployment model that keeps the agent recognisable after pod recreation.
Practitioner guidance
- Standardize workload identities Assign a unique identity to each service, sidecar, scheduler, and AI workload so access decisions are tied to runtime actors rather than shared credentials.
- Externalize authorization policy Move access rules out of application code and cluster config so policy changes can be versioned, reviewed, and audited separately.
- Add traceability at every hop Log which non-human identity requested, approved, and executed each action so teams can reconstruct behaviour across the platform.
Bottom line: Cloud-native governance is shifting toward identity-first control, with workloads and AI systems treated as operational subjects rather than anonymous infrastructure.
Glossary terms: Workload Identity, Policy-based authorization, Non-Human Identity (NHI), Runtime Guardrail
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 6:19 am
Identity has moved from support function to control plane. The article captures a cloud-native reality that many programmes still understate: identity is no longer just about login, token issuance, or service-to-service trust. It is now the layer where workload behavior, policy, and auditability are enforced. For IAM and platform teams, that means identity architecture has to be treated as production infrastructure, not an administrative wrapper.
A few things that frame the scale:
- Kubernetes production adoption has surged from 66% in CNCF's 2023 survey to 82% in 2025.
A question worth separating out:
Q: How should teams treat AI workloads that make autonomous decisions in production?
A: Treat them as operational actors that need runtime guardrails, traceability, and explicit policy boundaries before they can influence downstream actions. If an AI workload can persist state or trigger work, it should be governed like a first-class identity, not a detached application feature.
👉 Read our full editorial: KubeCon Europe 2025 shows identity becoming the control plane