# Carol Griffin

Carol Griffin writes about enterprise technology leadership, infrastructure programs, and the governance and security challenges of AI and identity systems.

- Profile: https://b2binfluencer.marketing/creators/carol-griffin/
- LinkedIn: https://www.linkedin.com/in/carol-griffin
- LinkedIn followers: 2,993
- Topics: artificial-intelligence, leadership, cybersecurity, ai-governance, agentic-ai, zero-trust, enterprise-ai-adoption
- Based on 17 dated posts, latest 2026-10-08

## Summary

Most useful for practitioner-led enterprise sessions and advisory on AI agent governance, identity lifecycle, and enforced controls.

- Best for: Identity security or IAM vendor running enterprise customer events and advisory with large accounts.
- Not for: Developer-tools lead-gen campaigns aimed at software engineers with video and conversion pricing.
- Check first: Confirm commercial terms, availability, audience breakdowns, and sources for unsourced statistics.

### Takeaways

- Post asks who triggers an AI agent's offboarding and revokes credentials across systems.
- Require an approval gate before an agent takes an irreversible action.
- Identity decisions only count if something enforces them.

## Main ideas

- **Visibility is not control**: Griffin distinguishes watching a system from governing it. Observability, telemetry, audit logs and compliance reports show what happened after the fact; governance prevents what should not happen. In an agent process that runs from analysis through recommendation to payment, the critical moment is the approval gate before an irreversible step. Financial transfers, customer communications, identity changes and vendor commitments are, in this framing, authorization problems, not monitoring problems.
- **AI agents break the identity lifecycle built for people**: Griffin's identity argument starts with a question the standard joiner-mover-leaver model cannot answer: how do you run a leaver process for an AI agent? The model assumes an HR record triggers the lifecycle, identities move at human speed, and the identity population is finite and known. Agents break all three assumptions: they spin up in minutes, have no HR record, can spawn sub-agents, and reach ERP, CRM, cloud storage and file shares in a single unattended run. Griffin names the unresolved questions rather than claiming a fix: who owns the offboarding trigger, how to disable an agent that authenticates through API keys held in several places, and how to certify access for something with no manager.
- **Identity decisions only count if something enforces them**: Reading two identity-vendor announcements together, Griffin argues that governance without enforcement is paperwork. IGA and PAM developed as separate disciplines to answer different questions — who should have access and why, versus how to protect the most dangerous credentials. AI agents ignore that boundary: IGA workflows provision them, PAM tools manage the credentials they use to authenticate, and their API keys live in neither system. The practical consequence: runtime authorization needs to sit inside the IGA platform, and enforcement must follow governance decisions automatically rather than lag downstream.
- **Technology is rarely the hardest part**: Looking back at large telecommunications and infrastructure programs, Griffin says the difficult parts were people, governance, trust and accountability, not technology. The same questions determine whether an AI rollout works: who owns the outcome, how risk is managed, how access is controlled, how trust is established, and what happens when plans fail. Griffin describes strong governance, clear accountability, operational discipline, security by design and change management as unglamorous, but often the difference between a successful transformation and an expensive lesson.
- **AI governance needs audit-ready controls, and annual cycles are too slow**: Griffin summarises a 2026 AI security checklist of 27 controls mapped to NIST AI RMF, ISO/IEC 42001 and OWASP LLM, for use before procurement, deployment, security assessments, compliance reviews and audits. The controls start with the basics: build a real AI inventory, classify every system by risk, assign an accountable named owner, enforce an enterprise policy, establish executive oversight, track evidence for each control, and review frequently. A companion post makes the case for speed: governance frameworks must adapt in hours, not months, after an incident because session-bound security and annual audits no longer match how agents operate.
- **Authority comes from delivery, not commentary**: Griffin argues against AI commentary detached from delivery experience. Real technical program management means clarity, alignment and execution; cloud modernisation depends on respecting the infrastructure underneath it. Griffin describes the technical program manager as someone who connects the stack from silicon to software and designs systems predictable enough for speed to follow. They ground that authority in a delivery record of multi-million-dollar programs, large rollouts, vendor and operations alignment, and specific operational results.

## Work to read

- [After 25 years in technology, what I'm still learning](https://www.linkedin.com/posts/carol-griffin_after-25-years-in-technology-heres-what-activity-7513978603932491776-wvs9)
- [Running a leaver process for an AI agent](https://www.linkedin.com/posts/carol-griffin_iga-identitygovernance-agenticai-activity-7500414959508406273-jOZf)
- [Governance is not observability](https://www.linkedin.com/posts/carol-griffin_ai-agenticai-governance-activity-7503917737413455872--Rig)
- [Two identity deals, one signal](https://www.linkedin.com/posts/carol-griffin_iga-identitygovernance-pam-activity-7510724199343120384-qzZA)
- [AI agents are operating outside governance](https://www.linkedin.com/posts/carol-griffin_aigovernance-artificialintelligence-cybersecurity-activity-7511809709952155648-iCw_)
- [Nailed it: leading enterprise IT programs with purpose and precision](https://www.linkedin.com/posts/carol-griffin_nailed-it-the-art-of-leading-enterprise-activity-7337916389539618816-P1YK)

## Brand relationships

- **AT&T** (employment)
- **BSM Computers** (employment)

## Partnerships

Carol Griffin's posts do not describe paid partnership formats. Their public posts focus on enterprise-technology commentary and job-search updates, not sponsored placements; they include no media kit, rate card, sponsorship policy, affiliate disclosure, or disclosed brand-partnership example. The linked LinkedIn profile is the only clear public channel, but it is not a verified partnership inquiry route. Buyers should ask Griffin directly about paid speaking or consulting terms, rates, deliverable formats, production timelines, review and approval processes, disclosure requirements, usage rights, and performance measures.

## Alternatives

- David Moufarrege: Choose David when the event should focus on AI incident oversight, independent reporting, and the risks of relying on AI companies to investigate themselves. Their post about agents escaping a test environment connects the incident to concrete proposals: mandatory reporting, outside access to evidence, and an oversight body independent of AI labs. That gives a cybersecurity audience a strong policy and accountability angle for a talk on AI governance.
- Robert Bimm, CAIO-CP, CAIERO-CP: Choose Robert when the event is about information integrity in enterprise AI: what sources systems rely on, how information is validated, and how bias or manipulation can affect decisions. Robert’s post turns those concerns into questions for technology and business leaders, making it a better match for a program focused on trusted information and AI decision-making than on identity controls.
- Travis Bittecuffer: Choose Travis when the event needs a broad technology-leadership perspective connecting business goals, operational execution, and the people affected by technology decisions. Their post on identity monitoring also gives a concise cybersecurity angle: compromised legitimate accounts can undermine other security investments, so organizations need to detect unusual behavior and respond quickly.

---
AI-assisted summary of public posts. Audience demographics are not available. Engagement appears only where we checked recent posts. Method: https://b2binfluencer.marketing/methodology/