Research Preprints · Identity & AI Security

Governing the machines that hold the keys.

Eight preprints on identity governance for AI agents: how autonomous systems are identified, granted access, reviewed, and held to account inside the enterprise IAM estate.

Browse the papersAbout the author
8Preprints
2Zenodo DOIs
3Research themes
2026Irving, Texas

Latest work

Featured preprints

No. 08AI Security EvaluationDOI

The Guardrail Cries Wolf: Prompt-Injection Detectors on the Text Security Teams Actually Send Them

October 19, 2026 · Prabin Shrestha

Once a prompt-injection detector sits in front of an enterprise copilot, the sales number stops applying. The open detectors that current guidance points teams toward were validated on short, generic prompts. Security work does not read like that. It reads like attack descriptions, remediation orders, and analyst notes that quote the ...

prompt injectionguardrail modelsfalse positive rateLLM security
Read paperDOCXZenodo ↗

No. 07AI Security EvaluationDOI

The Accuracy Illusion: Shortcut Learning in Machine-Learning Phishing Detectors

October 12, 2026 · Prabin Shrestha

Machine-learning phishing detectors routinely report accuracy between 95 and 99 percent, a range that suggests phishing detection is close to solved. Shortcut learning research shows why that reading is unsafe: a model can reach a high score by relying on correlations that happen to hold in training data instead of learning the detection ...

phishing detectionmachine learningshortcut learningadversarial robustness
Read paperDOCXZenodo ↗

Archive

All papers

Every preprint, newest first. Search by title, topic, or keyword, or filter by research theme.

No. 08AI Security EvaluationDOI

The Guardrail Cries Wolf: Prompt-Injection Detectors on the Text Security Teams Actually Send Them

October 19, 2026 · Prabin Shrestha

Once a prompt-injection detector sits in front of an enterprise copilot, the sales number stops applying. The open detectors that current guidance points teams toward were validated on short, generic prompts. Security work does not read like that. It reads like attack descriptions, remediation ...

prompt injectionguardrail modelsfalse positive rateLLM security
Read paperDOCXZenodo ↗

No. 07AI Security EvaluationDOI

The Accuracy Illusion: Shortcut Learning in Machine-Learning Phishing Detectors

October 12, 2026 · Prabin Shrestha

Machine-learning phishing detectors routinely report accuracy between 95 and 99 percent, a range that suggests phishing detection is close to solved. Shortcut learning research shows why that reading is unsafe: a model can reach a high score by relying on correlations that happen to hold in ...

phishing detectionmachine learningshortcut learningadversarial robustness
Read paperDOCXZenodo ↗

No. 06AI Agent Governance

The Alignment Tax Governing AI Agent Identity Inside the Enterprise IAM Estate

October 2026 · Prabin Shrestha

Autonomous AI agents now run in production as identity subjects that enterprise identity and access management (IAM) was never built to govern. An agent authenticates programmatically, executes at machine speed, delegates authority to sub-agents, crosses organizational trust boundaries, and ...

AI agent identityIAMidentity governancenon-human identity
Read paperDOCX

No. 05AI Agent Governance

Guests in the Machine: Extending Third-Party Identity Governance to Vendor-Embedded AI Agents

October 5, 2026 · Prabin Shrestha

Enterprises have learned to govern third-party people: a contractor receives a sponsored account, scoped access, an expiration date, and an offboarding workflow when the engagement ends. Vendor-embedded AI agents receive none of that treatment. Such agents arrive inside product updates, act under ...

third-party riskvendor AI agentssupply chainidentity governance
Read paperDOCX

No. 04AI Agent Governance

Segregation of Duties for AI Agents: Modeling and Enforcing Toxic Capability Combinations in Autonomous Tool Access

September 28, 2026 · Prabin Shrestha

Segregation of duties (SoD) rests on a simple rule: no single subject should hold the mix of privileges that makes fraud, or a serious error, possible without collusion. Identity governance platforms enforce that rule as pairs of conflicting entitlements, checked when access is provisioned and ...

segregation of dutiesSoDAI agentstoxic combinations
Read paperDOCX

No. 03Certification & Attestation

Certifying the Moment: A Session-Centric Framework for Governing Just-in-Time and Ephemeral Privilege

September 21, 2026 · Prabin Shrestha

Access certification runs on a fixed schedule and asks whether a person still needs a given access. The control rests on one assumption: the access is still present when the reviewer opens the campaign. For a growing share of privileged access that assumption fails. Just-in-time elevation, ...

just-in-time accessephemeral privilegeprivileged access managementsession
Read paperDOCX

No. 02Certification & Attestation

Certifying the Machine Workforce: A Framework for Access Recertification of AI Agent Identities

September 14, 2026 · Prabin Shrestha

Access certification rests on three assumptions: a manager who can attest for each account holder, a human resources system that signals when access should change, and a population small enough for human review on a quarterly or annual cycle. AI agents break all three. An agent holds API scopes, ...

AI agentsaccess recertificationnon-human identityIAM
Read paperDOCX

No. 01Certification & Attestation

From Rubber Stamp to Informed Attestation: A Framework for LLM-Assisted Access Certification in Identity Governance

September 12, 2026 · Prabin Shrestha

Access certification asks managers and application owners to attest that user access remains appropriate, yet the review screen gives the reviewer almost nothing to decide with: no plain-language explanation of what an entitlement grants, no record of whether the access was used, and no comparison ...

access certificationLLMidentity governanceattestation
Read paperDOCX
No papers match that searchTry a shorter term, or clear the theme filter above.

Research program

Three themes, one question

Who is accountable for what an AI agent does with its access? Each theme attacks that question from a different side of the IAM estate.

Certification & Attestation

Why access reviews fail when reviewers are given nothing to decide with, and how informed attestation, machine-workforce recertification, and session-level certification fix the review itself.

3 papers

AI Agent Governance

AI agents as identity subjects: segregation of duties for tool access, vendor-embedded agents inside third-party products, and the cost of fitting agent identity into an estate built for people.

3 papers

AI Security Evaluation

Measuring the detectors instead of trusting the brochure: shortcut learning in phishing models and false positives in prompt-injection guardrails, tested on the text security teams actually handle.

2 papers

Author

About

Prabin Shrestha

Identity & Access Management Practitioner

Practice
Identity governance, including Okta and SailPoint deployments
Education
B.S. Computer Science, McNeese State University
M.S. Information Technology (in progress), University of the Cumberlands
Location
Irving, Texas, USA

Prabin Shrestha is an identity and access management practitioner based in Irving, Texas, whose professional work centers on Okta and SailPoint deployments.

His research addresses identity governance for AI agents: how autonomous systems are identified, granted access, reviewed, and held to account inside the enterprise IAM estate. The work is written from deployment experience, for the practitioners who run certification campaigns, segregation-of-duties controls, and access reviews today and will inherit agent identities tomorrow.

All papers on this site are preprints published under a CC BY-ND 4.0 license: they may be shared unchanged with attribution. Papers 7 and 8 are also deposited on Zenodo with permanent DOIs.

LinkedIn ↗ ORCID ↗ Zenodo: Accuracy Illusion ↗ Zenodo: Guardrail Cries Wolf ↗