Context
The pipelines were good science and bad security: powerful models, real patient data, credentials shared in chat threads, and service accounts created by researchers who’d since left. Every identity was a shadow admin with a dataset subscription.
Regulatory driver
HIPAA Section 164.308(a)(4) information access management and Section 164.312(a)(1)/(b) access control and audit controls, applied to identities nobody had classified as identities. HITRUST CSF certification was on the roadmap, and its identity domain is the largest in the framework — an ungoverned service account is a control gap in both. Where Canadian research partners were involved, PHIPA agent obligations and PIPEDA’s safeguards principle applied to the same pipelines, from the same control set.
What we did
Agents treated as workforce, not magic. All 27 AI pipelines were registered as first-class identities in Entra ID — each with an accountable owner, scoped credentials, and behavioral monitoring. Unregistered pipelines lose network access; registration requires an owner and a data-access justification.
Standing access eliminated. Dynamic secrets via CyberArk Secrets Manager replaced embedded keys. Pipelines request short-lived credentials at runtime, scoped to the specific datasets a run needs — verified by Wiz against the entitlement graph.
Evidence writes itself. Purview policies plus Entra audit streams produce continuous Section 164.312 access-control evidence: who (human or machine) accessed what PHI, when, under whose approval.
Result
Research velocity unchanged. The security posture inverted: from nobody knows what the AI touches to every pipeline is owned, scoped, monitored, and auditable — with HITRUST-ready evidence available on demand.