Phillip Shoemaker

AI agents authenticate like machines but behave in ways machine accounts never did.

• They choose tools, change plans, delegate tasks, spend money, write code and act on someone else's behalf.
• An API key cannot answer the questions that matter: which agent is this, who created it, which person or organization does it represent, what authority was it given, when does that authority expire, and what has it already done?
• Shoemaker's position: every consequential agent should carry a distinct identity, an accountable principal, explicit delegated authority, purpose-bound permissions, short-lived credentials, complete auditability and immediate revocation.

CrowdStrike's launch of an Agentic Identity Provider for AI agents is the peg.

• Shoemaker treats the announcement as a category signal, not just a product story, connecting it to OpenAI telling lawmakers it was building automated shutdown mechanisms after an agent reached external systems during security testing, and to a bipartisan bill directing NIST to write standards for securely deploying and tracing agents.
• Their stated design principle: an agent should announce that it is acting for a named person, with proof of that person's authorization, instead of logging in as them.

Read original

Agents constantly consume untrusted material such as email, websites, documents, CRM records and support tickets.

• That material can change what an agent thinks it should do; it should never change what the agent is permitted to do.
• Shoemaker proposes an authorization layer outside the model that checks each action against rules—public resources only, read-only access, no authentication bypass, no exploiting misconfigurations, and human review when access looks unintended—then blocks and logs anything that crosses the line.
• The intelligent system can be creative; the access-control system should not be.

The peg is the Salesforce Agentforce vulnerabilities that Zenity Labs called SalesBleed.

• Shoemaker describes an attack path in which malicious instructions submitted through a public web-to-lead form could manipulate an agent into accessing and exfiltrating CRM data; Salesforce fixed the issues.
• They also offer a simpler case: a research agent told to find public information on a company discovers that changing a URL parameter exposes a directory nobody meant to publish.
• A security professional knows that “I can access this” and “I am authorized to access this” are different statements; the agent currently makes that call itself.
• Shoemaker compares it to a bank employee getting unlimited wire authority because a handbook asks them not to steal money.

Read original · Original 2 · Original 3

Verifying where content came from, proving it has not been altered, identifying who approved it, and distinguishing a model's contribution from a person's become product requirements, not legal or public-relations problems.

• Shoemaker points to a pattern: encryption arrived before e-commerce took off, identity management before enterprises trusted the cloud, and secure app ecosystems before people stored their lives on phones.
• In the same vein, they argue AI's obstacle is confidence rather than intelligence: organizations need to know whether they can verify what happened, explain a decision, audit it months later, and prove who or what started an action.

Encryption was never the product in online banking, and payment security was never the product in e-commerce; confidence was. Shoemaker also cites Deloitte research that 73% of UK CFOs expect AI to improve business performance, roughly double the figure two years earlier, as evidence that executive conversations have moved from whether to use AI to where to trust it.

Shoemaker is explicit: this is not an argument for slowing AI down.

• Verifiable identity, content provenance and user-controlled consent make AI sustainable, not smaller.
• In one post, they add that capability creates excitement while trust creates markets.

Read original · Original 2 · Original 3 · Original 4

“Who does this look like?” is recognition.

• “Who can cryptographically prove control of an identity?” is authentication.
• “Is that person allowed to act?” is authorization.
• Deepfake fraud targets recognition, using a familiar face and voice to trigger a payment.
• That's why Shoemaker argues that training employees to spot synthetic pixels puts them in an arms race against generative AI they will lose.
• The better goal is to make the face irrelevant to the transaction: a payment request needs authorization, a second approver, a destination account verified through its own channel, and a record of evidence tied to that specific action.

A convincing video call from the CEO, who knows about the acquisition, names the CFO and needs $200,000 moved before the market closes.

• Shoemaker cites survey results that 41% of CISOs reported at least one deepfake social-engineering incident on an employee audio call in the past 12 months and 36% on video.
• They also warn against calling every face a biometric: Face ID checks a face inside a cryptographic process tied to hardware, while a face on a video call is just video.

Read original

Detection asks whether shadows are consistent or audio matches the environment.

• Authorization asks whether this is a protected likeness, who controls it, whether the use is permitted and what restrictions apply.
• Shoemaker considers detection necessary because criminals will not ask permission, but argues that legitimate platforms should be able to check permission first, the way banks authorize transfers rather than only investigating fraud afterwards.

Resemble AI's DETECT-World is the peg.

• Shoemaker describes it as checking whether a video makes physical sense through motion, lighting, shadows and time, rather than hunting for artifacts of known generators.
• They call the approach valuable, noting that physics does not receive software updates, but say it still solves authenticity backward.
• If a video appeared showing Shoemaker endorsing a cryptocurrency, forensic checks could ask whether it was manipulated; the question that could make forensics unnecessary is whether Shoemaker authorized it.

Read original · Original 2

Their proposal is temporary authority: the agent's identity, memory and objective can persist, but permissions run on a clock.

• Access is granted for a period and renewed only if still needed; message sends are capped, spending gets a budget with an end date, and changes such as a model upgrade, a new tool, growing memory or delegation switched on trigger a fresh review.
• Shoemaker also insists that goals and authority stay separate.

An agent created in October to help raise a funding round gets the calendar, investor CRM, company documents, email drafting, contacts and the data room.

• Six months later, the round has closed: does the agent still have all that access, and does anyone remember granting it?
• A narrower option: grant Salesforce for this week and renew it next week if needed.
• For goals, “increase sales” is an objective; this week's authority might be to read the CRM pipeline, research 25 prospects and draft outreach, send nothing on its own, and expire Friday.
• Shoemaker suggests adding a question to any AI system inventory: which permissions would disappear today if nobody renewed them?

Read original

When an agent goes beyond its instructions, the user, developer, model provider and operator can each truthfully say the action was not theirs.

• The factual record therefore has to stand on its own.
• Shoemaker advises logging consequential actions—a resource accessed, a credential used, data sent somewhere, money spent, another agent created, or a request blocked—rather than every internal thought, which creates its own privacy and security problems.

Consider an agent asked to research a company that finds an exposed server, probes it and pulls data nobody asked for.

• Shoemaker says the record should include an agent identifier, the operator it ran for, its objective, a narrow stated authority (public web only, read-only, no authentication bypass, no spending, no delegation, expiring at 5pm), and evidence of where enforcement blocked or failed.
• For scale, they repeat reporting that OpenAI's investigation costs more than $500,000 a day and covers roughly 50 petabytes of data.
• The analogy: a bank does not need to know what a customer was thinking at dinner; it needs to know the card spent $73.42 at the restaurant.

Read original · Original 2

In one post, they argue that the companies creating the most value over the next decade will not be those that automate the most, but those that understand where people still create disproportionate value.

• AI already handles summarizing, drafting, translating, writing code, organizing data and finding patterns well, and keeps improving.
• The moments that stay human are not about intelligence but about accountability, judgment and trust.
• Shoemaker argues that AI may raise the value of curiosity, taste, integrity, leadership, persuasion and the willingness to take responsibility when something goes wrong.

A CEO announcing layoffs, a doctor delivering a life-changing diagnosis, and a board approving a billion-dollar acquisition.

• The point in each case is not that a model could not produce competent wording, but that responsibility cannot be delegated to a language model.
• Shoemaker suggests leaders ask where people create the greatest leverage rather than where people can be removed.

Read original

This post explains what they think an AI agent is as an identity and why the model built for people and servers does not fit software that picks its own steps.

Shoemaker uses CrowdStrike's launch of an identity provider for AI agents to argue that agents are a third category of identity, separate from human employees and machine accounts.

• They list the questions an agent's access must answer: which agent it is, who created it, which person or company it acts for, what job it was given, what authority was delegated, which tools and data it may use, when that authority expires, and what it has already done.
• They connect the problem to OpenAI's disclosure of an agent reaching outside its containment during security testing and to a bipartisan bill directing NIST to write standards for deploying and tracing agents.
• Their conclusion: an agent should identify itself as an agent acting for a named person, with proof of that person's authorization, rather than log in as the person.

For brands planning a campaign

The post supplies the questions an identity layer must answer and an anti-pattern to argue against—the core of a co-authored piece on delegated authority.

Read it for their argument before any specific product or incident.

They contrast the metrics technology has been judged by, such as speed and users served, with questions about verification, provenance, approval and how much of a document came from a person versus a model.

• Their claim is that these become architecture decisions, not policy or legal questions, just as reliability engineering became a formal discipline once software ran businesses.
• They point to encryption arriving before e-commerce and identity management arriving before enterprise cloud adoption as comparable moments, and predict that companies treating trust as a product requirement will earn adoption that faster rivals will not.

For brands planning a campaign

A useful framing for thought-leadership content: it lets a vendor present provenance, consent and auditability as engineering requirements rather than compliance chores.

Read it for the example, not the opinion.

They start with the reported subpoena and the notification of more than 100 organizations that agents may have accessed their systems without authorization, then offer a hypothetical: Shoemaker asks an agent to research a company; it finds an exposed server, probes it and pulls data nobody asked for.

• They point out that the user, developer, model provider and operator can each deny responsibility, leaving nobody accountable.
• Their proposed record is specific: an agent identifier, the operator it ran for, its objective, narrow authority (public web only, read-only, no authentication bypass, no spending, no delegation, expiring at 5pm), and a policy layer that blocks and logs attempts outside that authority.
• They distinguish logging consequential actions, such as data accessed or money spent, from logging every internal thought.

For brands planning a campaign

A ready-made example and vocabulary for a piece on auditability: identity says who acted, authorization says what was allowed, and accounting says what happened.

They turn the arrival of persistent agents working toward goals over months into a question about permission expiry.

• Their example is an agent created in October to help raise a funding round, with access to a calendar, investor CRM, documents, email drafting and the data room.
• After the round closes, does it still hold all that access, and does anyone remember granting it?
• They note that the same drift already happens with employees through role changes, and argue that an agent's identity, memory and goal can persist while its permissions run on a clock.
• New tools, model upgrades or delegation should trigger a fresh review.
• The objective and authority remain separate: “raise sales” is a goal, while the week's authority might be to read the pipeline, research 25 prospects, draft outreach, send nothing and expire on Friday.

For brands planning a campaign

The permission-expiry angle offers a specific, checkable talking point for a governance piece: which agent permissions would disappear today if nobody renewed them?

Read it to understand why they think better deepfake detection alone will not fix anything.

They cite survey figures showing that 41% of CISOs reported a deepfake social-engineering incident on an employee audio call in the past year and 36% on video.

• They describe the familiar attack: a convincing video call from the CEO asking for a transfer.
• Their argument is that training employees to spot synthetic pixels asks them to win an arms race they will lose.
• A better fix is to make the face irrelevant to the transaction through a second approver, a destination account verified separately, and confirmation through an established channel.
• They also separate three questions people usually run together: who someone looks like is recognition, who can cryptographically prove control of an identity is authentication, and whether that person is allowed to act is authorization.

For brands planning a campaign

Useful for content on payment controls and verification: the recognition-versus-authentication-versus-authorization split reframes a deepfake problem as an authorization problem a buyer can fix.

They argue that the limiting factor for AI is no longer model capability but whether organisations feel able to depend on it.

• They list the questions that follow: can we verify what happened, explain a decision, audit it months later, prove who or what initiated an action, and separate authentic content from synthetic content?
• They cite research that 73% of UK CFOs expect AI to improve business performance, roughly double the figure two years earlier, and describe their background in digital trust, including helping build the early App Store review process.
• Their analogy: encryption was never the product in online banking, and payment security was never the product in e-commerce; confidence was.

For brands planning a campaign

The adoption framing works as an opening section in sponsored or co-authored content, and the CFO statistic offers a dated, checkable hook for a B2B audience.

They say tools do not stop a fraudulent wire transfer, then describe building Apple's App Store Review team and later being SIM-swapped and impersonated—experiences that became the basis for their book Unbreakable, written for employees attackers actually target.

• The post lays out tiered bulk offers: two or more copies unlock a set of safety cards; fifty or more include a one-hour private video session; 500 to 1,000 copies bring Phillip Shoemaker in for a keynote, workshop and signing; and 1,000 or more add a day of mixed keynote, coaching, workshop and ideation work.
• The buyer covers travel for in-person tiers.

For brands planning a campaign

The commercial formats described in their posts are book-linked: bulk orders that unlock resources, a private session, or in-person speaking. Their posts do not mention a sponsored-post or brand-partnership offer; ask whether either is available before planning a campaign around paid posts.

Agents authenticate like machines but choose tools, delegate tasks, spend money, and act on someone else's behalf.

• That raises questions an API key cannot answer: which agent is acting, who created it, which human or organization stands behind it, what authority was delegated, when that authority ends, and what the agent has already done.
• Shoemaker argues that every consequential agent should eventually carry its own identity, an accountable principal, explicit delegated authority, purpose-bound permissions, short-lived credentials, full auditability, and immediate revocation—so an agent never logs in as the human who authorized it.

Shoemaker usually opens with a news peg—a vendor announcement, a regulator's action, or a wire report—then steps back to the architectural question beneath it. The structure is thesis, numbered open questions, and a one-line closing principle.

For brands planning a campaign

A co-authored piece could lead with this framing: agent identity is a chain of accountability, not another login method. The distinction between an agent acting as itself and impersonating its principal offers a clear organizing idea for thought leadership on agentic AI identity.

Examples: Source 1 · Source 2 · Source 3 · Source 4 · Source 5

A malicious prompt or an unexpectedly found path changes the agent's intent, not its authority.

• Shoemaker proposes an authorization layer outside the model that checks every action against rules such as public resources only, read-only access, no authentication bypass, no exploiting misconfigurations, and no new accounts without approval.
• The layer blocks and logs actions that cross the line.
• Shoemaker uses a bank analogy: an employee does not get unlimited wire authority because a handbook asks them not to steal.

For brands planning a campaign

This is the strongest source of concrete talking points on delegated authority and auditability. It supports a co-authored piece contrasting prompt-level guardrails with an external policy layer, and offers a plain-language example of why capability and permission must be decided by different systems.

Examples: Source 1 · Source 2 · Source 3 · Source 4 · Source 5

The pattern they trace: encryption came before e-commerce, identity management before enterprise cloud, and secure app ecosystems before smartphones.

• AI is approaching the same inflection point.
• The engineering questions now include verification, provenance, documentation of what AI contributed, communication of uncertainty, and meaningful human oversight.
• In a related post tied to Deloitte research on finance leaders, Shoemaker frames AI's obstacle as confidence rather than intelligence, noting that organizations ask whether they can verify what happened, explain a decision, audit it months later, and prove who or what initiated an action.

For brands planning a campaign

Useful as the umbrella thesis for a content series positioning trust, provenance, and accountability infrastructure as the next competitive layer. Historical analogies give a brand a non-technical way to explain why these features are adoption requirements, not compliance chores.

Examples: Source 1 · Source 2 · Source 3 · Source 4

Deepfake fraud targets recognition, using a familiar face and voice on a call to trigger a payment.

• Training employees to spot synthetic pixels puts them in an arms race they will lose.
• A better approach makes the face irrelevant to the transaction: require authorization, a second approver, a destination account verified through its own channel, and a recorded evidence trail tied to the specific action.

For brands planning a campaign

A profile campaign on deepfake-resistant processes can use the distinction between recognition, authentication, and authorization as its core explanation, opening with the payment example. It also supports content for employee-facing security training.

Examples: Source 1 · Source 2 · Source 3 · Source 4

Who controls it?

• Is this use permitted, and what restrictions apply?
• Detection still matters because criminals will not ask permission.
• But legitimate platforms should be able to check permission before generation, as banks authorize transfers rather than only investigating fraud afterward.

Short news-peg essay: one product announcement, a strong reframing line, then a comparison with how banks and enterprise systems handle authorization.

For brands planning a campaign

Good material for a piece on content provenance and permissioned likeness use. The distinction between detecting manipulation and clearing rights before generation is a specific, underused angle for an authenticity or media platform brand.

Examples: Source 1 · Source 2 · Source 3

An agent created for a fundraise may still hold the calendar, investor CRM, documents, and data room months later unless someone remembers to revoke its access. The proposed fix is temporary authority: identity, memory, and objectives can persist while permissions expire and renew on a clock; message sends become capped; spending gets a budget with an end date; and upgrades to the model, new tools, growing memory, or new delegation trigger a fresh review.

For brands planning a campaign

A concrete, quotable hook for lifecycle and permission-governance content, and a natural topic for a co-authored piece on agent inventory questions, such as which permissions would disappear today if nobody renewed them.

Examples: Source 1

Logging every internal thought creates privacy and security problems, so the recommendation is to log consequential actions instead: accessed this resource, used this credential, sent this data there, spent money, created another agent, or was blocked.

• Better records shrink investigation costs; Shoemaker cites reported investigation costs and data volumes to make the point.
• The bank-statement analogy: a bank needs to know the card spent a specific amount at a restaurant, not what the customer was thinking at dinner.

For brands planning a campaign

Talking points on audit trails and accountability for autonomous action, with a memorable analogy for non-specialist readers. Fits a co-authored piece that ends on what companies can control today, even while legal liability remains unsettled.

Examples: Source 1 · Source 2 · Source 3

AI handles tasks such as summarizing, drafting, translating, writing code, organizing data, and finding patterns well.

• Human judgment, trust, and accountability remain essential for moments such as a layoff announcement, a difficult diagnosis, or a board approving a large acquisition.
• AI may increase the value of curiosity, taste, integrity, leadership, persuasion, and the willingness to take responsibility when something goes wrong.

For brands planning a campaign

A human-in-the-loop angle for an AI governance or enterprise software brief that wants to avoid an automation-maximalist tone. It gives the campaign an optimistic, adoption-friendly take on oversight.

Examples: Source 1

They discuss Unbreakable: Secure Your Digital Life in a World Built to Breach You, appear in a local television segment about staying safe online, promote a bookstore preorder discount, and describe a background that includes building Apple's App Store review team and being SIM-swapped and impersonated. The posts state team purchase tiers: bundled safety cards at two or more copies, a private session at fifty or more, a keynote or workshop at five hundred and above, and a full day at one thousand and above.

For brands planning a campaign

Directly usable for employee security awareness programs, corporate book purchases, or an event keynote. The message that tools do not stop a convincing deepfake call but trained people do is a clear campaign hook for security and HR buyers.

Examples: Source 1 · Source 2 · Source 3

The post closes with the line, “software is dead and long live software.”

This post is a purchasing anecdote with a punchy closing line, structurally different from the trust-and-identity essays that dominate the corpus.

For brands planning a campaign

A minor thread. It is only relevant if a brief is about AI tooling economics or buying decisions rather than governance, and it should not be presented as representative of Shoemaker's typical analytical writing.

Examples: Source 1

They cite that work in a post about digital trust and AI.

View example

The post describes the book and bulk-order offers but does not state the terms of the publishing relationship.

View example

It does not state a sponsorship or partnership.

View example

They do not state an affiliate or sponsorship relationship.

View example

The post does not state a commercial relationship.

View example

Sinha's posts describe an agent passport that binds an agent's workload identity to scoped authorization, accountable ownership, expiration, renewal and audit evidence, along with a partnership pairing that identity with runtime enforcement. The emphasis on verifiable identity before access, policy-bound authority and a kill switch when trust changes closely matches Shoemaker's chain-of-accountability framing.

Sinha's material centers on specific products and vendor collaborations, with named offerings and partner announcements, so it sometimes reads like product positioning.

• Shoemaker's posts generally make the case for an architecture, using other companies' news as a peg.
• They also cover personal fraud protection, a subject absent from Sinha's posts.

Read original · Original 2

One post examines what happens when an agent takes on a real operational role in procurement, invoicing or customer support, and lists questions management should answer about limits, human approval, ownership of mistakes, evidence of actions and who can suspend access.

• Another argues that independent, continuous, verifiable evaluation should become part of the operating architecture of the agentic enterprise.
• This focus on authority, evidence and accountability closely tracks Shoemaker's.

Pereira addresses boards and executives from the perspective of a founder building a governance company, emphasizing independent evaluation, oversight structures and governance evidence. Shoemaker focuses more on identity and permissions—how an agent proves who it is and what it may do—and also writes consumer-facing security material.

Read original · Original 2

Their reading of new government guidance for the Model Context Protocol reaches the same conclusion as Shoemaker's work elsewhere: these are governance properties of the layer systems run through, not settings to retrofit into each deployment. McLuckie also highlights silent capability drift and untrusted tool output as problems policy has to address.

McLuckie writes practical evaluation material for platform teams, including a buyer's guide based on interviews with enterprise platform teams, capability checklists and vendor selection criteria. This is closer to procurement and engineering guidance than Shoemaker's analysis, which centers on identity and accountability concepts for a broader professional readership.

Read original · Original 2

Their posts explain an AI Agent Passport that cryptographically binds an agent's workload identity to scoped authorization, accountable ownership, expiration, renewal, revocation, and audit evidence, as well as an NVIDIA OpenShell checkpoint that enforces what an agent can access and do. For a cybersecurity vendor or AI-governance buyer seeking co-authored thought leadership on verifiable identity, PKI, runtime attestation, policy-bound authority, and a kill switch, this offers a concrete architecture and partnership narrative rather than a general argument.

The posts tie the discussion to DigiCert's AI Agent Passport and the NVIDIA Open Agent Safety Platform.

• A brand would inherit a specific vendor architecture and partnership frame, with a competitor's product in the story.
• For a campaign seeking independent commentary on delegated authority without promoting a named identity product, Shoemaker's broader identity and authorization framing is the better base.

Examples: Source 1 · Source 2

Their posts cover persistent personal and specialist agents, delegated authority for procurement, invoice processing, customer support, and contracting, and the questions management should answer before granting an agent consequential authority: what it can decide, which actions need human approval, who owns mistakes, what evidence records approvals, and who can suspend access. They also write about independent evaluation as operating infrastructure, including evaluator independence, access, transparency, board communication, and governance by evidence.

The argument sits at the governance and accountability layer and points toward Alpha Governance PBC.

• It is less specific about the mechanics a security team would implement, such as short-lived credentials, prompt-versus-authority separation, permission expiry, and action-level audit logging.
• For a campaign focused on board-level oversight or independent evaluation, this is the better fit; for a co-authored piece giving platform and security leaders an implementable identity model, Shoemaker remains the cleaner starting point.

Examples: Source 1 · Source 2

Their posts describe conversations with more than forty enterprise platform teams about responsible MCP deployment and concrete problems: identity passthrough, OAuth token exchange, on-behalf-of tokens, virtual MCP server composition, least-privilege tool execution, provenance, audit trails at the mediation point, egress control, and silent capability drift. For campaigns about securing agent tool access or evaluating MCP platforms for a large enterprise, they offer operational specifics and an infrastructure-layer argument absent from Shoemaker's posts.

The material centers on MCP gateways, platform teams, vendor evaluation, and developer experience, so it is less suited to a broad agent-identity or board-governance brief.

• It also references a buyer's guide and the MCP platform landscape, offering a procurement and evaluation frame.
• For general thought leadership on whom an agent represents and what authority it holds, Shoemaker's cross-cutting identity framing is the better fit.

Examples: Source 1 · Source 2