Vanderbilt CIO Shane Callahan: reuse identity governance for AI agents

Callahan's argument rests on the breadth of a university's operations rather than on any new technology. Vanderbilt's environment spans residential life, athletics, its own police department and more than $1 billion in research, and the same person can be a student, a staff member and a donor at once, each with a different profile. That overlap is what makes access decisions hard in the first place.

Into that setting come AI agents, which Callahan says add another layer to identity security. Distinct identities and scoped access can limit what an agent does, but in his account they do not settle who bears responsibility when an agent steps outside its guardrails, or whether cyber insurance covers the fallout when another group or another company is affected.

His proposed answer is procedural, not technical: build on the technology-intake and cross-functional governance processes an institution already has. The stakes look likely to hinge on whether those existing processes can be stretched to cover agent liability, and on whether insurers and peer institutions reach a shared view of where responsibility falls — something Callahan says is not understood at this point.