{"id":9949,"date":"2026-06-11T10:42:04","date_gmt":"2026-06-11T08:42:04","guid":{"rendered":"https:\/\/www.idstory.com\/?p=9949"},"modified":"2026-06-15T14:38:55","modified_gmt":"2026-06-15T12:38:55","slug":"idstory-identity-manager-sprava-non-human-identit-a-ai-agentu","status":"publish","type":"post","link":"https:\/\/www.idstory.com\/cs\/idstory-identity-manager-sprava-non-human-identit-a-ai-agentu\/","title":{"rendered":"IdStory: Spr\u00e1va Non-Human Identit a AI agent\u016f"},"content":{"rendered":"

 <\/p>\n

<\/p>\n

\n

IdStory: Spr\u00e1va Non\u2011Human Identit a AI agent\u016f<\/h1>\n

Servisn\u00ed \u00fa\u010dty, RPA boti, API kl\u00ed\u010de a AI agenti. Identity, kter\u00e9 nikdy neodejdou na v\u00fdpov\u011b\u010f, ale auditor se na n\u011b dnes pt\u00e1 explicitn\u011b. IdStory m\u00e1 architekturu pro NHI a AI agenty v produkci dnes p\u0159es modul technick\u00fdch \u00fa\u010dt\u016f.<\/p>\n

Strojov\u00e9 identity ve firemn\u00edch s\u00edt\u00edch p\u0159eva\u017euj\u00ed nad lidsk\u00fdmi v pom\u011bru des\u00edtek ku jedn\u00e9. Tato p\u0159evaha sama o sob\u011b nebyla doned\u00e1vna probl\u00e9m. Servisn\u00ed \u00fa\u010det pro z\u00e1lohovac\u00ed software vznikl, d\u011blal svou pr\u00e1ci a nikoho moc netr\u00e1pil. Co se zm\u011bnilo: do hry vstoupili AI agenti, kte\u0159\u00ed se chovaj\u00ed jinak ne\u017e klasick\u00e9 servisn\u00ed \u00fa\u010dty. A regul\u00e1to\u0159i, kter\u00fdm NIS2 a DORA daly do ruky p\u00e1ku, na kterou se ptaj\u00ed explicitn\u011b.<\/p>\n

Tento \u010dl\u00e1nek shrnuje, pro\u010d jsou non-human identity (NHI) a AI agenti dnes governance prioritou, a jak je IdStory \u0159e\u0161\u00ed p\u0159es modul technick\u00fdch \u00fa\u010dt\u016f.<\/p>\n

<\/p>\n

\n
\n
82:1<\/div>\n
strojov\u00fdch identit
\nna 1 zam\u011bstnance<\/div>\n
CyberArk 2025<\/div>\n<\/div>\n
\n
40\u00a0%<\/div>\n
podnikov\u00fdch aplikac\u00ed
\nbude m\u00edt AI agenty
\ndo konce 2026<\/div>\n
Gartner<\/div>\n<\/div>\n
\n
95\u00a0%<\/div>\n
CISO pochybuje, \u017ee by
\nzachytili zneu\u017eit\u00ed
\nAI agenta<\/div>\n
Saviynt 2026<\/div>\n<\/div>\n<\/div>\n

AI agent vs. klasick\u00fd servisn\u00ed \u00fa\u010det<\/h2>\n

Klasick\u00fd servisn\u00ed \u00fa\u010det je p\u0159edv\u00eddateln\u00fd. N\u011bkdo (typicky syst\u00e9m) ho vyvol\u00e1, on ud\u011bl\u00e1 svou v\u011bc. AI agent je v r\u00e1mci sv\u00fdch p\u0159id\u011blen\u00fdch opr\u00e1vn\u011bn\u00ed autonomn\u00ed. S\u00e1m rozhoduje, kterou akci a kdy vykonat. To je velk\u00fd rozd\u00edl pro audit i pro \u00fato\u010dnou plochu.<\/p>\n\n\n\n\n\n\n\n\n
Atribut<\/th>\nServisn\u00ed \u00fa\u010det<\/th>\nAI agent<\/th>\n<\/tr>\n<\/thead>\n
Pou\u017eit\u00ed opr\u00e1vn\u011bn\u00ed<\/td>\nVyvolan\u00e9 syst\u00e9mem<\/td>\nAgent v r\u00e1mci sv\u00fdch opr\u00e1vn\u011bn\u00ed s\u00e1m vol\u00ed, kterou akci a kdy vykonat<\/td>\n<\/tr>\n
Chov\u00e1n\u00ed<\/td>\nP\u0159edv\u00eddateln\u00e9<\/td>\nZ\u00e1vis\u00ed na vstupu a kontextu<\/td>\n<\/tr>\n
\u00datok<\/td>\nKr\u00e1de\u017e hesla nebo kl\u00ed\u010de<\/td>\nKr\u00e1de\u017e hesla plus prompt injection (p\u0159eps\u00e1n\u00ed z\u00e1m\u011bru agenta vstupem)<\/td>\n<\/tr>\n
Auditn\u00ed stopa<\/td>\n\u201eCo \u00fa\u010det ud\u011blal\u201c<\/td>\n\u201eCo \u00fa\u010det ud\u011blal a pro\u010d to ud\u011blal\u201c<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Pokud m\u00e1 AI agent opr\u00e1vn\u011bn\u00ed \u010d\u00edst z\u00e1kaznickou datab\u00e1zi, lze ho p\u0159es prompt injection donutit, aby v r\u00e1mci tohoto opr\u00e1vn\u011bn\u00ed ud\u011blal jinou v\u011bc, ne\u017e pro kterou byl pou\u017eit. M\u00edsto shrnut\u00ed jednoho z\u00e1znamu ud\u011bl\u00e1 hromadn\u00fd export. Pr\u00e1va agenta se nem\u011bn\u00ed, m\u011bn\u00ed se jeho z\u00e1m\u011br. To je d\u016fvod, pro\u010d u AI agent\u016f je\u0161t\u011b v\u00edce plat\u00ed princip minim\u00e1ln\u00edho nezbytn\u00e9ho opr\u00e1vn\u011bn\u00ed.<\/p>\n

Jak na spr\u00e1vu AI agent\u016f<\/h2>\n

Spr\u00e1va AI agent\u016f a NHI stoj\u00ed na dvou kl\u00ed\u010dov\u00fdch principech: naj\u00edt v\u0161echny identity v prost\u0159ed\u00ed a \u0159\u00eddit je s lidsk\u00fdm vlastnictv\u00edm a auditn\u00ed stopou.<\/p>\n

\n
\n
1. Naj\u00edt je<\/div>\n

Kompletn\u00ed invent\u00e1\u0159 AI agent\u016f a NHI nap\u0159\u00ed\u010d cloudem, aplikacemi, za\u0159\u00edzen\u00edmi.<\/p>\n

IdStory:<\/strong> Registrace p\u0159es pr\u016fvodce nebo API.<\/p>\n<\/div>\n

\n
2. \u0158\u00eddit je<\/div>\n

Ka\u017ed\u00fd agent m\u00e1 lidsk\u00e9ho vlastn\u00edka, \u0159\u00edzen\u00fd \u017eivotn\u00ed cyklus, schv\u00e1len\u00e1 opr\u00e1vn\u011bn\u00ed, auditn\u00ed stopu.<\/p>\n

IdStory:<\/strong> Pln\u00e9 pokryt\u00ed p\u0159es modul technick\u00fdch \u00fa\u010dt\u016f.<\/p>\n<\/div>\n<\/div>\n

Architektura IdStory: Osoba \u2192 Technick\u00e9 aktivum \u2192 Technick\u00e9 \u00fa\u010dty<\/h2>\n

<\/p>\n

\n
\n
Osoba<\/div>\n
Lidsk\u00fd vlastn\u00edk
\n(garant + spr\u00e1vce)<\/div>\n<\/div>\n
\u2192<\/div>\n
\n
Technick\u00e9 aktivum<\/div>\n
AI agent,
\naplikace,
\nintegra\u010dn\u00ed platforma<\/div>\n<\/div>\n
\u2192<\/div>\n
\n
Technick\u00e9 \u00fa\u010dty<\/div>\n
\u00da\u010dty na c\u00edlov\u00fdch
\nsyst\u00e9mech (AD, CRM, DB)<\/div>\n<\/div>\n<\/div>\n

Technick\u00fd Asset zast\u0159e\u0161uje konkr\u00e9tn\u00ed aplikaci, integra\u010dn\u00ed platformu nebo AI agenta. Pod n\u00edm vis\u00ed jeden nebo v\u00edce technick\u00fdch \u00fa\u010dt\u016f na c\u00edlov\u00fdch syst\u00e9mech. Ka\u017ed\u00fd asset m\u00e1 povinn\u00e9 lidsk\u00e9 vlastn\u00edky: garanty (byznysov\u00e1 odpov\u011bdnost, schvalov\u00e1n\u00ed) a spr\u00e1vce (technick\u00e1 operativa).<\/p>\n

AI agent v produkci ve 4 kroc\u00edch<\/h2>\n

Jak vypad\u00e1 \u017eivotn\u00ed cyklus AI agenta v IdStory od registrace po ukon\u010den\u00ed:<\/p>\n

\n
\n
1<\/div>\n
\n
Registrace<\/div>\n

Zalo\u017e\u00edme Technick\u00fd Asset \u201eAI agent: Customer Service\u201c, ur\u010d\u00edme garanty a spr\u00e1vce, nastav\u00edme z\u00f3nu a platnost.<\/p>\n<\/div>\n<\/div>\n

\n
2<\/div>\n
\n
Nastaven\u00ed p\u0159\u00edstup\u016f<\/div>\n

Pod asset zalo\u017e\u00edme \u00fa\u010dty do CRM, ticketingu, znalostn\u00ed b\u00e1ze.<\/p>\n<\/div>\n<\/div>\n

\n
3<\/div>\n
\n
Provoz<\/div>\n

Auditn\u00ed z\u00e1znam zachyt\u00e1v\u00e1 ka\u017edou zm\u011bnu. Recertifikace ka\u017ed\u00fdch 6 m\u011bs\u00edc\u016f potvrzuje aktu\u00e1ln\u00ed pot\u0159ebu.<\/p>\n<\/div>\n<\/div>\n

\n
4<\/div>\n
\n
Ukon\u010den\u00ed<\/div>\n

Garant agenta deaktivuje. \u00da\u010dty jdou do karant\u00e9ny, pak smaz\u00e1n\u00ed. Auditn\u00ed z\u00e1znam z\u016fst\u00e1v\u00e1.<\/p>\n<\/div>\n<\/div>\n<\/div>\n

Kl\u00ed\u010dov\u00e9 funkce modulu Technick\u00fdch \u00fa\u010dt\u016f<\/h2>\n
\n
\n
V\u00edcen\u00e1sobn\u00ed vlastn\u00edci<\/div>\n

Garanti a spr\u00e1vci v libovoln\u00e9m po\u010dtu, p\u0159\u00edmo nebo p\u0159es roli. Sd\u00edlen\u00e1 odpov\u011bdnost odpov\u00edd\u00e1 realit\u011b enterprise.<\/p>\n<\/div>\n

\n
Bezpe\u010dnostn\u00ed z\u00f3ny<\/div>\n

Asset v produk\u010dn\u00ed z\u00f3n\u011b nesm\u00ed m\u00edt \u00fa\u010det v dev z\u00f3n\u011b. IdM operaci odm\u00edtne.<\/p>\n<\/div>\n

\n
Karant\u00e9na p\u0159ed smaz\u00e1n\u00edm<\/div>\n

Po deaktivaci jde \u00fa\u010det do karant\u00e9ny (nap\u0159. 30 dn\u00ed), pak teprve smaz\u00e1n\u00ed na c\u00edlov\u00fdch syst\u00e9mech.<\/p>\n<\/div>\n

\n
Kask\u00e1dov\u00e1 deaktivace<\/div>\n

Deaktivace assetu deaktivuje v\u0161echny \u00fa\u010dty pod n\u00edm. \u017d\u00e1dn\u00e9 osamocen\u00e9 \u00fa\u010dty.<\/p>\n<\/div>\n

\n
Recertifikace<\/div>\n

Pravideln\u00e9 potvrzov\u00e1n\u00ed vlastnictv\u00ed a opr\u00e1vn\u011bn\u00ed.<\/p>\n<\/div>\n

\n
P\u0159\u00edznak PAM<\/div>\n

Ozna\u010den\u00ed assetu spadaj\u00edc\u00edho pod spr\u00e1vu privilegovan\u00fdch p\u0159\u00edstup\u016f.<\/p>\n<\/div>\n

\n
Platnost od\/do<\/div>\n

Asset se po datu s\u00e1m deaktivuje. AI agent pro Q4 kampa\u0148 p\u0159estane existovat 31.\u00a012.<\/p>\n<\/div>\n

\n
Auditn\u00ed z\u00e1znam<\/div>\n

Kdo, kdy, co zm\u011bnil. Filtrovateln\u00e9 podle entity, akce, autora, obdob\u00ed.<\/p>\n<\/div>\n

\n
Hromadn\u00e9 akce a CSV import<\/div>\n

Hromadn\u00fd import agent\u016f.<\/p>\n<\/div>\n

\n
P\u0159edkonfigurovan\u00e9 role<\/div>\n

Garant a dr\u017eitel jako p\u0159edp\u0159ipraven\u00e9 role pro snadn\u00e9 p\u0159id\u011blen\u00ed opr\u00e1vn\u011bn\u00ed.<\/p>\n<\/div>\n<\/div>\n

Compliance: kde to bol\u00ed<\/h2>\n

Identity governance pro NHI a AI agenty nen\u00ed akademick\u00fd probl\u00e9m. Audity se na to dnes ptaj\u00ed explicitn\u011b.<\/p>\n\n\n\n\n\n\n\n\n
P\u0159edpis<\/th>\n\u00da\u010dinnost<\/th>\nCo vy\u017eaduje<\/th>\n<\/tr>\n<\/thead>\n
NIS2 \/ Z\u00e1kon \u010d. 264\/2025 Sb.<\/td>\n1. 11. 2025<\/td>\n\u0158\u00edzen\u00ed p\u0159\u00edstup\u016f a spr\u00e1va identit, nerozli\u0161uje lidsk\u00e9 a nelidsk\u00e9<\/td>\n<\/tr>\n
DORA<\/td>\n17. 1. 2025<\/td>\nIdentity v\u010detn\u011b servisn\u00edch \u00fa\u010dt\u016f pro API a platby (finan\u010dn\u00ed sektor)<\/td>\n<\/tr>\n
ISO 27001<\/td>\nplat\u00ed<\/td>\nAnnex A.5.15, A.5.16, A.5.18: \u0159\u00edzen\u00ed p\u0159\u00edstup\u016f a \u017eivotn\u00ed cyklus<\/td>\n<\/tr>\n
EU AI Act<\/td>\netapy 2025\u20132027<\/td>\nDohledatelnost a odpov\u011bdnost pro vysokorizikov\u00e9 AI syst\u00e9my<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Shrnut\u00ed<\/h2>\n

NHI a AI agenti jsou dnes governance prioritou regul\u00e1tor\u016f i auditor\u016f. Bez centr\u00e1ln\u00ed vrstvy, kter\u00e1 d\u00e1v\u00e1 ka\u017ed\u00e9 strojov\u00e9 identit\u011b lidsk\u00e9ho vlastn\u00edka, \u017eivotn\u00ed cyklus a auditn\u00ed stopu lze t\u011b\u017eko splnit po\u017eadavky NIS2 a DORA, ani bezpe\u010dn\u011b \u0161k\u00e1lovat nasazen\u00ed AI agent\u016f.<\/p>\n

IdStory tu vrstvu poskytuje p\u0159es modul technick\u00fdch \u00fa\u010dt\u016f s architekturou Osoba \u2192 Technick\u00e9 aktivum \u2192 Technick\u00e9 \u00fa\u010dty. V\u00edcen\u00e1sobn\u00ed vlastn\u00edci, bezpe\u010dnostn\u00ed z\u00f3ny, karant\u00e9na, kask\u00e1dov\u00e1 deaktivace a auditn\u00ed z\u00e1znam.<\/p>\n<\/div>\n

<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

  IdStory: Spr\u00e1va Non\u2011Human Identit a AI agent\u016f Servisn\u00ed \u00fa\u010dty, RPA boti, API kl\u00ed\u010de a AI agenti. Identity, kter\u00e9 nikdy neodejdou na v\u00fdpov\u011b\u010f, ale auditor se na n\u011b dnes pt\u00e1 explicitn\u011b. IdStory m\u00e1 architekturu pro NHI a AI agenty v produkci dnes p\u0159es modul technick\u00fdch \u00fa\u010dt\u016f. Strojov\u00e9 identity ve firemn\u00edch s\u00edt\u00edch p\u0159eva\u017euj\u00ed nad lidsk\u00fdmi v […]<\/p>\n","protected":false},"author":15,"featured_media":9958,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[32,27,34],"tags":[],"class_list":["post-9949","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-identity-manager","category-idstory","category-konektory"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts\/9949","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/comments?post=9949"}],"version-history":[{"count":0,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts\/9949\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/media\/9958"}],"wp:attachment":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/media?parent=9949"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/categories?post=9949"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/tags?post=9949"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}