PGA of America Tightens Identity Controls as AI Agents Expand Across Enterprise

When AI agents begin operating across an organization's systems, identity security moves to the forefront of operational concerns. The burden falls particularly hard on smaller technology departments that lack the resources to build dedicated teams around infrastructure, security and identity governance. The Professional Golfers' Association of America has taken a deliberate path to reduce this complexity by anchoring its approach on Okta and Auth0, freeing its developers to focus spending and personnel on initiatives that serve members and customers directly, according to Kevin Scott, the organization's chief technology officer.

I think the biggest one is we don't have much of a team – it's small, it is lean. I don't mean to be reductive, but if we were to spend half of the technology budget on administering systems, none of our customers are ever going to come along and say thank you for that.

Kevin Scott, CTO of the PGA of America

Scott shared these insights during remarks at Okta's Oktane event, speaking with Krista Case and Rebecca Knight in an exclusive broadcast on theCUBE, SiliconANGLE Media's livestreaming platform. The conversation centered on how the PGA of America is simplifying identity security while rolling out AI agents in live environments.

Reducing layers rather than adding them

Rather than piling on new infrastructure to manage identity controls, the PGA of America has eliminated entire layers. The organization has shut down its own data centers, VPNs, Active Directory systems and conventional corporate network architecture. This reduction in the number of systems where identity rules can fragment also minimizes the risk of control gaps across different user groups, Scott noted.

The way that we've tried to get through it is to simplify things as much as we possibly can. If you need to handle the same type of use case or persona management across multiple systems, that's where you can get into trouble. We try to streamline things as much as we can.

Kevin Scott

AI introduces additional complexity because agents can act on behalf of employees to access enterprise applications and information. The PGA of America is keeping this ecosystem tightly managed by directing staff toward a single AI platform and applying identity controls at the level of technologies like MCP and agent gateways. This prevents a scattered ecosystem of independent agents from taking root across the organization, Scott explained.

We try to make ours the best option. Use gravity to create the right defaults for people. That has allowed us to … centralize things. We don't have a proliferation of agents around. We kind of know where they're going to be running it from and we can authenticate … each independent user in all the ways that Okta's been talking about this week.

Kevin Scott

AI governance expands beyond the technology team

The expansion of AI into business operations has shifted the composition of decision-making groups. As AI systems begin touching employee workflows, governance structures and business processes, the PGA of America is bringing finance, human resources, legal and technology into closer collaboration. Decisions that previously fell squarely within IT's domain now require input from multiple departments before deployment, Scott pointed out.

I think it's put greater importance on creating a shared understanding between finance and HR and legal as well as technology. It used to be easier to make a standalone technology decision. I think now it's more obvious that there are things that really deserve the attention of these multiple perspectives.

Kevin Scott

The organization pairs this expanded oversight with measured caution in deploying AI. An internal council reviews new tools and use cases before they reach production, and human judgment remains embedded in the process. Organizations can still move at reasonable speed, but hands-on experience with the technology proves essential—teams need sufficient familiarity to evaluate vendors and determine what should be built versus bought, Scott argued.

https://www.youtube.com/embed/UIth8O-mdM8?feature=oembed

You build that up by experience. Turns out a lot of the stuff's actually easier than you might think. My comment of confidence is that it's all learnable. Even an old guy like me can actually understand how this stuff works and be able to get a company to a place where it makes you better at make-buy decisions, better at critiquing vendors.

Kevin Scott