Delinea applies Iris AI to privileged access and session auditing

Delinea combines privileged access management with AI-assisted authorisation and auditing. Its Iris AI offering can analyse recorded administrative sessions, while its agent-security approach aims to control access at the moment an agent acts. These are related but different products to evaluate: one explains what happened, and the other controls what is allowed to happen.

01 / ProductA privileged-access platform with two distinct AI jobs

The Delinea platform spans discovery, credential management, privilege controls and access governance across human, machine and AI identities. Iris AI is the intelligence layer described for real-time authorisation and auditing. Understanding those separate jobs helps a buyer avoid treating a recorded-session summary as evidence that the underlying access was prevented.

The Iris Auditing guide describes analysis of privileged SSH and RDP recordings using computer vision and large language models. Its evidence includes visual text extracted from frames, keystroke information and process traces. The resulting labels and summary are an aid for investigation, especially when a reviewer would otherwise need to inspect long recordings without an obvious starting point.

For AI agents, the runtime-authorisation page describes policies applied inside connections to systems such as databases, SSH hosts and Kubernetes clusters. Delinea says credentials can be injected without exposing them to the agent and access evaluated at the action level. Those are vendor-described mechanisms that need to be demonstrated on the particular supported connection the customer intends to use.

02 / AudienceFor teams with too much privileged activity to review manually

A practical audience is a privileged-access team with recorded administrative sessions but limited capacity to inspect them all. The task is not to generate a pleasant summary; it is to locate the parts of a session that deserve attention and explain why. A useful evaluation begins with recordings whose legitimate administrative purpose is already understood.

Another audience is an engineering team connecting an AI agent to operational resources. The agent may need to inspect a database or carry out a bounded support task without receiving broad, reusable credentials. The access design should specify the allowed operation and accountable owner before the team evaluates Delinea’s enforcement path.

Okta provides a useful adjacent view of identity and authentication, while SailPoint is relevant to access governance. Delinea’s focus here is privileged access, session evidence and execution-time controls. These systems can address different parts of one identity programme, so compare the actual enforcement and review responsibilities rather than simply counting overlapping feature names.

03 / WorkflowProposed workflow: review a known administrative recording

Choose a non-production recording with a documented, benign administrative task and an authorised reviewer. Include a small number of known events, such as a privilege elevation and an approved configuration change. Preserve the original recording and the expected sequence. That gives the reviewer a meaningful reference for evaluating both useful detections and missing context.

Run Iris Auditing only after confirming the tenant and subscription support the feature. Compare the generated labels and summary with the original session. Ask whether the analysis locates the important activity and whether it correctly distinguishes an expected administrative action from an unexplained one. A label such as privileged activity is an invitation to investigate, not proof of malicious behaviour.

The working guide describes policies that select sessions using subjects, targets and optional time conditions. Start with a deliberately narrow policy so the team can observe what gets analysed and how much allocation it consumes. Before expanding to a wider population, identify which sessions genuinely benefit from automatic analysis and which are already covered by an effective review process.

The auditing safety statement requires human oversight and explains that probabilistic models can produce incomplete or inaccurate outputs. Keep the reviewer’s decision separate from the generated summary. If the analyst finds a missed step or misleading description, retain enough original evidence to explain the discrepancy and decide whether it changes the investigation.

This is a proposed workflow based on public documentation, not a Sequenced test. A useful pilot produces a set of annotated sessions, the time spent validating them and a record of what analysis did not establish. It should also show what happens to the review process when no AI analysis is available, so usage exhaustion does not silently create an audit gap.

04 / PricingAuditing is an add-on with an observable consumption limit

Delinea's platform package comparison lists Essentials, Standard and Enterprise. The table presents auditing powered by Iris AI as an add-on for Standard and Enterprise, with custom pricing requested from the vendor. This does not establish a universal price per user, session or analysed hour; the order needs to specify the entitlement and allocation.

The working guide provides a consequential operating detail: the subscriptions area shows allocated and consumed Iris Auditing hours, and analysis of new sessions stops when the allocation is exhausted. Budgeting should therefore consider the duration and selection of recordings, not merely the number of administrators. Ask how additional capacity is purchased and how the team is notified before the allocation runs out.

Keep runtime authorisation for agents separate in the proposal. The public platform presentation brings the capabilities together, but a buyer should not infer that purchasing auditing enables every AI identity control. Have the vendor map the planned database, remote-session or agent workflow to the necessary products and deployment components.

05 / DistinctionsRecorded evidence and agent identity provide different kinds of accountability

Iris Auditing’s useful distinction is its connection to a session recording and supporting activity streams. An analyst can revisit the underlying activity rather than accept a standalone explanation. The operational benefit would come from shortening the path to relevant evidence while preserving the original material needed to make a defensible decision.

Delinea’s agent-identity explanation describes Delinea ID assigning agents distinct, verifiable identities and linking them to a human sponsor. This addresses a different accountability question: who authorised an agent’s activity? It should not be reduced to a generic service-account inventory, because delegation and ownership need to remain intelligible when an agent performs multiple actions.

The broader runtime approach then asks whether a specific action should proceed with the available authority. For a reader, the distinction is between identity, authorisation and subsequent audit. A clear design can connect all three; a product demonstration that shows only one should not be described as proving the complete chain. Ask to see the hand-off between the relevant components.

06 / QuestionsEligibility and data processing are material deployment constraints

The Iris Auditing documentation says the feature is not available in FedRAMP-compliant tenants. The safety statement also says Iris AI auditing and authorisation are unavailable in the United Arab Emirates because of local hosting requirements. These are concrete exclusions in the reviewed documentation, so an organisation in either scope should resolve eligibility before planning a pilot around the feature.

The same safety statement identifies Azure Computer Vision and Azure OpenAI as processing services. It describes inference remaining in the selected US or EU region, while feedback sent for support can be stored elsewhere. That distinction matters when approving a feedback workflow: ordinary inference and diagnostic submissions should not be treated as identical data movements.

For recorded sessions, consider the information visible on screen as well as the typed command. A recording may include output, paths or business data unrelated to the administrative intent. Agree what can be submitted for analysis and who can inspect the result. This public-source review does not establish the suitability of any particular recording or a compliance outcome for the customer.

For agent controls, test the actual connection route and supported action granularity. A policy is useful only if the operation goes through the enforcement point. Ask how the product identifies an agent-driven connection and what occurs when the agent changes tools, delegates work or encounters an unsupported protocol. Those are deployment questions rather than assumed product failures.

07 / DecisionChoose the evidence or enforcement problem you need to solve

Delinea is a relevant AI-security option for organisations that need privileged activity to remain understandable and controlled as automation expands. Iris Auditing offers a concrete review workflow, while the wider platform addresses identity and authorisation for agents. The clearest purchase starts by identifying which of those problems is causing the current operational gap.

For auditing, begin with known recordings, confirm eligibility and measure useful review assistance against consumed hours. For agents, begin with one allowed operation and a verifiable identity. Expand only when the team can explain the permission, the action and the resulting evidence. That is a stronger basis for adoption than assuming a platform-wide AI label covers every control.