#448 - Sponsor Spotlight - Opal Security

<p>Howard Ting, CEO of Opal Security, joins Jeff Steadman for a Sponsor Spotlight covering identity governance for both human and non-human identities. Howard traces his path through RSA Security, Microsoft, Palo Alto Networks, Nutanix, and Cyberhaven before returning to identity to lead Opal. The conversation covers why disabling a departing employee&#39;s account rarely ends their access, the orphaned tokens, service accounts, and agents left behind, and why visibility has to come before ownership and risk analysis. Howard and Jeff dig into agent intent and authority: whether an agent can declare its own intent, why permissions should stay a subset of what its human creator holds, and how narrowly scoped, single-task agents make governance easier. They also cover how Opal matches AI decision capacity to a growing volume of access requests, including how the company&#39;s Paladin AI supports approvers and campaign creators today. The episode closes with Opal&#39;s announcement of a unified platform for governing human, non-human, and agent identities together, extending Paladin&#39;s decisioning to agents and introducing Policy Insights to help security teams balance friction against risk. Howard shares his view that identity has to shift from an episodic, event-driven practice to a continuous one, along with a lighthearted detour into 90s video games.</p><p><br></p><p>Connect with Howard: https://www.linkedin.com/in/howardting/</p><p><br></p><p>Learn more about Opal Security: https://www.opal.dev/</p><p><br></p><p>Connect with us on LinkedIn:</p><p><br></p><p>Jim McDonald: https://www.linkedin.com/in/jimmcdonaldpmp/</p><p><br></p><p>Jeff Steadman: https://www.linkedin.com/in/jeffsteadman/</p><p><br></p><p>Visit the show on the web at idacpodcast.com</p><p><br></p><p>00:10 Intro and welcome</p><p>01:01 Howard&#39;s identity origin story: RSA, Microsoft, Kim Cameron</p><p>02:48 What Opal does: unified control plane for human and non-human identities</p><p>04:16 The opal.dev domain and how Opal got its name</p><p>06:42 Termination and lifecycle: why access doesn&#39;t fully go away</p><p>09:33 Session management and orphaned accounts</p><p>13:57 Visibility as the first step in identity governance</p><p>17:31 Can an agent declare its own intent?</p><p>20:29 Authority: should an agent ever exceed its creator&#39;s permissions?</p><p>22:12 Inside Opal: Risk Center and Policy Insights</p><p>25:41 How Opal connects to systems and collects usage data</p><p>27:30