[insanitybit]

This would be paired with deterministic controls. So you have, for example, "engineers can only read from the database, and only after they've perform a 2FA" but then there's context like "why is this engineer reading from the payments table when their IP is in a weird location and they're supposed to be on PTO?" and perhaps that's something a model decides.

It's possible to turn that second thing into a sort of "risk score" but it's very hard and a model is going to potentially be better at it.

[prmph]

This is going to make things worse for all kind of use cases that are legitimate but seem non-standard or marginal.

Heck, many websites I visit on the web cannot understand why I, a Ghanaian living in Ghana, might be interested in the service offered or the information therein. I am sometimes blocked for no good reason.

If you are in a third world country, the web is extra hostile. This is going make things worse.

[YeahThisIsMe]

It doesn't even take being in a "third world country".

Plenty of US websites are blocking access from EU IP addresses because of our data protection laws.

Local news companies are the biggest offenders in this regard.

[skinfaxi]

> This is going make things worse.

Isn't this for enterprises managing access to corporate resources?

[prmph]

I'm talking about the general direction this is taking.

I don't think once this is established in enterprises it is going to stop there.

[insanitybit]

That's not what the article advocates for though. This is about enterprise policy decisions for internal access.

[billyp-rva]

The engineer could be fixing an emergency issue while on vacation. For financial data, that would hopefully be an auto-deny anyway until someone on-site whitelists their IP. And this is if they aren't using VPNs. Adding AI to this party feels like it wouldn't really help.

[insanitybit]

> The engineer could be fixing an emergency issue while on vacation.

Okay, but that's why there are always loud "breakglass" escalation options for access.

> that would hopefully be an auto-deny anyway until someone on-site whitelists their IP

About as far from "zero trust" as any solution could be.

[jayd16]

Finally, we've invented a way to abolish all the reliability and speed of discrete computing. We're well on our way to re-inventing the layers of bureaucracy and red tape the tech industry had disrupted.

I can't wait to fill out a form describing why I want to do something I have permission to do but the AutoBureaucrat5000 says no anyway.

[thewebguyd]

The weird IP would already be handled by existing zero-trust controls. Users in Entra ID (for example) can be assigned a risk score already based on deterministic factors. On a managed device or not, which MFA methods they have registered, eligible for any privileged roles, where they are, impossible travel detection, etc. You can even require human approvers.

This reads to me to be more for continuous behavioral monitoring once the access is gained via the deterministic controls. You wouldn't leave "Can person X access resource Y" up to the AI model, that's already decided based on the existing rules. Where the model comes in is "Is person X behaving in an expected way while using resource Y." Like, downloading a bunch of data when they've never done that before, might get flagged for either a session revocation, or a human review, or prompt for additional authentication, etc.

[cyanydeez]

Non of it really matters if the end product is just going to be ignored because there's zero people who want to be the guard in the panopticon and therefore, it'll still be given to an AI to watch and make it's dumb decisions about how trust worthy you are to do X, Y and Z.

Even if the middle is deterministic, if one end is just going to be lazily hooked up to an AI, it's the shitty dystopian future.

[oscarcp]

That just gave me shivers down my spine of people eventually becoming so lazy that the AI will decide who to fire based on a massive amount of circumstantial data that very likely has tiny cumulative errors that will lead to classifying your best personnel as a bums and liabilities.

[eastbound]

EU IA Act: The AI can’t make decisions about humains without them being first reviewed by a human.

What will really happen: You can’t really perform your work, so you are slower than others, so they fire you based on bad performance.

Horrible startup idea: Discrimination as a service, by means of IA without pretending it’s IA.