Limitations
Review audit log details for registered agent actions, understand current limitations
of Agent Identity Security, and find solutions for common configuration and authentication
issues.
| Where Can I Use This? | What Do I Need? |
|---|
- Prisma AIRS — Agent Identity Security (US East region)
|
- Agent Identity Security module licensed and activated via Strata Cloud
Manager
- AI Gateway activated with at least one data plane instance running
- Enterprise IdP (Okta or Microsoft Entra ID) federated with CyberArk Idira
- User directory synced to AI Gateway via Cloud Identity Engine (CIE)
|
This section outlines the functional boundaries, regional support, and deployment
prerequisites for the current release of Agent Identity Security. Ensure your environment
meets these structural requirements before configuring tenant settings or establishing
access policies.
- Regional availability: Agent Identity Security is currently available in US East
(N. Virginia) only. Expansion to additional regions is planned for future releases.
- Dedicated Idira tenant: Activating Agent Identity Security always creates a new,
dedicated Idira tenant, even for customers who already have one. It cannot be merged with
or migrated into an existing Idira tenant.
- Fixed tenant mode: The Idira tenant created for Agent Identity Security works
only through Prisma AIRS. It cannot later be converted into a standalone Idira
tenant.
- AI Gateway required:Agent Identity Security requires AI Gateway to be deployed on
the same tenant.
- Management through Prisma AIRS only:Agent identity is managed only from the
Prisma AIRS user interface on Strata Cloud Manager.
- Enterprise Hosted Agents Only: Agent Identity Security supports enterprise-hosted
AI agents. Endpoint or client-based AI agents are currently not supported.
- Scope of Access Policies: Access policies currently apply only to Model Context
Protocol (MCP) interactions. Agent-to-Agent (A2A) communication policies are currently not
supported.
