One agent,
two identities.
AI agents broke the two-box model of enterprise IAM. Every agent operates in two modes — acting for a human and acting as itself — and most systems can’t tell which mode is active.
Agents break the two-box identity model
Enterprise IAM assumes every principal is a human or a machine. An agent is neither and both — and it acts at machine speed.
Box 1 — Humans
- Interactive login, MFA, sessions
- A manager who approves access
- Slow, reviewable actions
- “Last login” means something
Box 2 — Machines
- Static keys, service accounts
- No interactivity, no consent
- Deterministic, fixed behavior
- No owner, no manager
Agents — neither / both
- Switch between delegated and autonomous mode
- Select tools and targets at runtime
- Spawn sub-agents across trust boundaries
- Spun up in seconds, abandoned just as fast
Five camps, one stack
Each camp answers a different question. No vendor covers the whole problem — buyers assemble layers.
NHI / Agent Security
“What agents exist, and are they behaving?”
Solves: shadow-agent discovery, posture, JIT/ephemeral credentials, intent-based control, runtime gateways, NHI-native access certification. Visibility ≠ enforcement — demand the ability to block a tool call, not just alert on it.
Platform IdP Suites
“How do agents live in the enterprise directory?”
Solves: directory-grade agent objects, Conditional Access, lifecycle governance, OBO token models, runtime MCP gatewaying. Licensing gravity; Okta’s agent features still pre-GA.
Agent-Native IdPs
“How do external agents authenticate to my product?”
Solves: OAuth 2.1 + PKCE for MCP servers, DCR / CIMD registration, token vaulting, consent, tool-level scopes. Builder-side only — does not govern the agents your workforce adopts.
Authorization Engines
“May this identity do this action, right now?”
Solves: per-action / per-tool decisions, ReBAC graphs for RAG, zero standing privilege, human-in-the-loop consent. Assumes identity is established upstream.
Workload Identity Infra
“What is this workload, cryptographically?”
Solves: attestation, short-lived SVIDs, secretless mTLS, delegation with TTL scoping, isolated agent runtimes. SPIFFE alone answers “what is it” — not “on whose behalf” or “may it”.
▲ Buyers assemble upward. No single layer — and no single vendor — solves the whole problem.
Who covers what
Twelve representative vendors against the nine capabilities that matter.
| Vendor | Discovery | AuthN | Per-action AuthZ | Delegation / OBO | Human-in-loop | Cred. mgmt | Runtime enforce | Audit / attribution | Lifecycle |
|---|---|---|---|---|---|---|---|---|---|
| Microsoft Entra Agent ID | |||||||||
| Okta / Auth0 | |||||||||
| Ping Identity for AI | |||||||||
| Descope | |||||||||
| WorkOS | |||||||||
| Cerbos | |||||||||
| Permit.io | |||||||||
| SpiceDB / AuthZed | |||||||||
| Astrix | |||||||||
| Oasis | |||||||||
| Aembit | |||||||||
| Teleport |
The plumbing is standardizing fast
Everything reuses OAuth rather than reinventing it. The MCP authorization spec hardened through multiple revisions.
MCP auth v1
OAuth 2.1 + PKCE becomes the baseline; authorization-server metadata discovery.
Resource-server model
MCP servers reclassified as OAuth resource servers. RFC 9728 mandatory; RFC 8707 audience-binds tokens.
Current stable
Client ID Metadata Documents replace DCR as the recommended registration path; OIDC discovery; incremental scope consent.
Next revision (RC)
Issuer validation against authorization-server mix-up attacks. Treat this as a vendor-conformance gate.
IETF draft -04. Uses existing SSO trust to mint cross-app tokens for agents — the IdP sees and controls what agents touch.
Agent-to-agent task delegation and discovery via agent cards. Donated by Google to the Linux Foundation in 06/2025.
Signed intent, cart, and payment mandates as verifiable credentials — proof a real user authorized a purchase.
Workload identity across trust domains; the attestation layer MCP deliberately leaves open.
What nobody solves well
Four problems remain open across every camp — and they are exactly what regulators will ask for first.
Scope attenuation down the chain
Human → Agent A → Agent B → Service D: each hop should carry a narrower slice of authority. No widely deployed system enforces monotonic scope reduction across an arbitrary chain.
Full delegation-chain attribution
Nested act claims can represent the chain but are informational. Two-party attribution exists; N-hop lineage does not.
Autonomous vs. delegated, reliably
Subject/actor token models and blended identity are the strongest attempts, but separation becomes fragile across gateways and sub-agents.
Regulator-ready traceability
Regulatory expectations will demand precisely the chain-of-custody evidence that the market cannot yet fully deliver.
Map your scenario to a starting point
Anchor on Entra Agent ID + Agent 365 — directory-grade identity, sponsorship, and Conditional Access in one place.
Start with WorkOS, Descope, or Stytch for enterprise SSO, token vaulting, consent, and tool-level scopes.
Use SpiceDB / OpenFGA, Cerbos, or Permit.io for relationship graphs, policy-as-code, and MCP gateway controls.
Start with Astrix, Oasis, or Token Security for discovery and lifecycle governance before agents scale into production.
Use SPIFFE as the floor, then Teleport, Vault, or Aembit for runtime access, secrets, and blended identity.
Assemble a stack. No single box solves this.
Want to train your team on agentic security risks?
SECODE turns AI-era security topics into hands-on labs your developers can actually complete.
Book a demo