Publication Scope and IP Boundary: This reference architecture is a personal KrisperTech publication based on public Cloudflare services, publicly available documentation, and a personal demo implementation. It is not an official Cloudflare product document. It does not disclose Cloudflare internal material, customer architecture, roadmap information, proprietary field assets, internal enablement content, source code, private configuration, secrets, or customer-specific imple

Artificial intelligence is changing enterprise cyber risk faster than many governance programs can adapt. The issue is no longer only that attackers are using AI to write better phishing emails, automate reconnaissance, or accelerate vulnerability discovery. The larger problem is that enterprises are also embedding AI into business workflows, SaaS platforms, developer environments, and security operations before identity, access control, monitoring, and risk ownership models

Publication Scope and IP Boundary: This reference architecture is a personal KrisperTech publication based on public Cloudflare services, publicly available documentation, and a personal demo implementation. It is not an official Cloudflare product document. It does not disclose Cloudflare internal material, customer architecture, roadmap information, proprietary field assets, internal enablement content, source code, private configuration, secrets, or customer-specific imple

The cybersecurity conversation around AI has shifted quickly. Google Threat Intelligence Group recently reported the first instance it has identified of a threat actor using a zero-day exploit that Google believes was developed with AI assistance [1]. That was the warning shot. Microsoft’s latest security announcement shows the other side of the same shift: defenders are now using AI agents to discover vulnerabilities, validate exploitability, and accelerate security research

Executive Summary The National Institute of Standards and Technology (NIST) is actively exploring how identity, authentication, and authorization must evolve to support AI systems and autonomous agents. Recent federal direction and concept work point toward a future where non-human identities (NHIs), including AI agents, must be governed with the same rigor as human users. For enterprises, this represents a structural shift in how trust is established and enforced. Organizati