Yubico and Delinea Tie Human Approval to AI Agent Identity Controls

Yubico and Delinea have launched an integration designed to prove not just what an AI agent is allowed to do, but which verified human approved a high-risk action before the agent carried it out. The companies said the offering is meant to close a growing accountability problem in enterprise identity systems as AI coding and operations agents take on more privileged work.

The integration brings Yubico’s Role Delegation Tokens into the Delinea platform alongside StrongDM’s runtime authorization capabilities and StrongDM ID. Yubico said the tokens are backed by YubiKey hardware and provide cryptographic proof that a specific physically present human approved a specific action with defined scope and constraints. Delinea said its side of the integration adds centralized identity governance and just-in-time runtime authorization across human and non-human identities.

Both companies are framing AI agents as one of the fastest-growing identity classes in the enterprise. Their argument is that software-based controls can authenticate agents and enforce policy, but do not reliably prove that a human actually approved a sensitive action. Hardware attestation alone does not solve the problem either, because it cannot evaluate policy or govern agent identities at scale. The combined platform is intended to bind those two layers together in a single control chain. The pitch is especially relevant for environments where autonomous systems can trigger code changes, infrastructure actions or privileged access requests faster than existing review processes can document.

Non-human identity exposure has been surging as attackers target API keys and session tokens. NIST has also opened a comment period on AI agent identity and authorization, and vendors including Saviynt and Wiz have moved to govern non-human identities and AI agents across cloud environments.

Yubico and Delinea are now adding a hardware-rooted proof-of-human-approval layer to that governance push. The companies are aiming at software factories, privileged operations and other environments where an AI system may execute the task, but the organization still needs durable evidence that a real person authorized it. If enterprises adopt that model, agent activity would be tied more tightly to both policy controls and named human accountability.

Sources: Yubico

–

By the ID Tech Editorial Team