PGA of America Streamlines Identity Architecture to Support AI Deployment
As AI agents gain access to enterprise systems, the Professional Golfers' Association of America has simplified its infrastructure to manage identity security without expanding its lean technology team.
Managing identity security grows more critical as artificial intelligence agents operate across organizational systems. For smaller technology teams lacking the capacity to maintain extensive infrastructure and security operations, this challenge becomes particularly difficult. The Professional Golfers' Association of America has taken a deliberate path toward reducing complexity by building its approach around Okta and Auth0. This strategy enables its development staff to direct resources toward initiatives that directly benefit members and customers, according to Kevin Scott, the organization's chief technology officer.
I think the biggest one is we don't have much of a team – it's small, it is lean. I don't mean to be reductive, but if we were to spend half of the technology budget on administering systems, none of our customers are ever going to come along and say thank you for that.
Kevin Scott, chief technology officer of the PGA of America
Scott shared his insights with Krista Case and Rebecca Knight during Okta's Oktane event, in a conversation broadcast exclusively on theCUBE, SiliconANGLE Media's livestreaming platform. The discussion centered on how the PGA of America is making identity security less burdensome while putting AI agents into production environments.
Identity security starts with less complexity
Rather than adding more systems to manage, the PGA of America has eliminated infrastructure layers. The organization has discontinued its data centers, VPNs, Active Directory systems and conventional corporate network infrastructure, thereby reducing the number of places where identity controls can fragment or become inconsistent. This elimination of redundancy also narrows the potential for security gaps across different user groups, Scott observed.
The way that we've tried to get through it is to simplify things as much as we possibly can. If you need to handle the same type of use case or persona management across multiple systems, that's where you can get into trouble. We try to streamline things as much as we can.
Kevin Scott
AI introduces additional complexity because agents can interact with enterprise applications and access data on behalf of users. The PGA of America has maintained a relatively unified environment by directing staff toward a single AI platform and applying identity controls through technologies such as MCP and agent gateways. This approach prevents independent agents from proliferating throughout the organization, Scott explained.
We try to make ours the best option. Use gravity to create the right defaults for people. That has allowed us to … centralize things. We don't have a proliferation of agents around. We kind of know where they're going to be running it from and we can authenticate … each independent user in all the ways that Okta's been talking about this week.
Kevin Scott
AI adoption spreads decision-making across the business
The expansion of AI has reshaped who gets involved in technology decisions. As AI systems touch employee processes, compliance requirements and business operations, the PGA of America has brought together finance, human resources, legal and technology teams. Decisions that previously fell solely to information technology now require input from multiple departments before deployment, Scott noted.
I think it's put greater importance on creating a shared understanding between finance and HR and legal as well as technology. It used to be easier to make a standalone technology decision. I think now it's more obvious that there are things that really deserve the attention of these multiple perspectives.
Kevin Scott
The organization combines this expanded governance structure with measured caution in rolling out AI. An internal council reviews new tools and use cases before they reach production, and human oversight remains essential. Organizations can still move forward at a reasonable pace, but practical familiarity with the technology is necessary so teams can properly assess vendors and determine what to develop in-house versus purchase, Scott argued.
https://www.youtube.com/embed/UIth8O-mdM8?feature=oembed
You build that up by experience. Turns out a lot of the stuff's actually easier than you might think. My comment of confidence is that it's all learnable. Even an old guy like me can actually understand how this stuff works and be able to get a company to a place where it makes you better at make-buy decisions, better at critiquing vendors.
Kevin Scott