Signal SentrySearchUpdated Oct 28, 05:30 UTCAM Drop
Frontier watch · Protocols & interop

Agent identity and least-privilege access

How will agents prove who they are and get scoped, revocable access to tools across org boundaries, and whose identity model wins?

Why it matters

Agents that act with pasted API keys or a user's full rights are a security and audit gap. Standard agent identities and delegated, scoped tokens decide whether companies can let agents touch real systems and partners safely.

State of play

Newest first. Each claim is our summary of the linked primary source, with a short quote from it.

  1. AnnouncedOct 8, 2026Source

    Google says every Gemini agent gets its own cryptographically attested identity with least-privilege permissions, stamped into its logs, and all agent traffic passes through an Agent Gateway that enforces company policy.

    Every agent gets its own identity, cryptographically attested and governed like an employee, with least-privilege permissions.

    What it does not show: Keynote post; it gives no spec, docs or availability date for these controls and does not say how the attestation works.

  2. AnnouncedOct 8, 2026Source

    The IESG approved the charter of a new IETF Agent Communication Protocols (agentproto) working group, which notes agents may need authentication separate from the users who delegated to them.

    AI agents act as autonomous software entities that may need to be authenticated independently of the users who delegated authority to them.

    What it does not show: A charter only (approval date from the charter's datatracker history); its core deliverable is a dialog management protocol, none adopted yet.

  3. AnnouncedAug 22, 2026Source

    MCP's new roadmap makes agent identity a priority: servers should recognize agent identities via existing standards (DPoP, workload identity federation, ID-JAG, token exchange).

    We want MCP servers to have a standardized way to recognize and trust those agent identities, built on existing standards rather than pasted API keys and long-lived tokens.

    What it does not show: A roadmap, not a spec; no agent identity mechanism is in the MCP specification yet.

  4. DocumentedJul 28, 2026Source

    MCP's 2026-07-28 spec formally deprecates Dynamic Client Registration in favor of Client ID Metadata Documents, alongside issuer validation and issuer-bound client credentials.

    Dynamic Client Registration itself is now formally deprecated in favor of CIMD.

    What it does not show: DCR keeps working for backward compatibility for now; the post does not measure CIMD support among authorization servers.

  5. DocumentedJul 6, 2026Source

    An individual IETF Internet-Draft by authors from AWS, OpenAI, Okta, Ping Identity, Zscaler and Defakto proposes agent auth practices built on WIMSE and OAuth 2.0 rather than new protocols.

    Rather than defining new protocols, this document describes how existing and widely deployed standards can be applied or extended to establish agent authentication and authorization.

    What it does not show: An informational individual draft (revision 03), not adopted by a working group and not a standard.

  6. DocumentedJun 18, 2026Source

    MCP's maintainers say the Enterprise-Managed Authorization extension is stable: the client gets an ID-JAG from the company identity provider at sign-in and exchanges it for MCP server tokens.

    Under the hood, the client obtains an Identity Assertion JWT Authorization Grant (ID-JAG) from the IdP during single sign-on and exchanges it for an access token from the MCP server’s authorization server.

    What it does not show: The post names Okta as the first supported identity provider; the ID-JAG grant itself is still an IETF draft, not an RFC.

  7. ShippingMay 1, 2026Source

    Microsoft says Entra Agent ID, its identity and access management for AI agents, is generally available.

    Microsoft Entra Agent ID is now generally available.

    What it does not show: Date is the docs page's last update; Entra's release notes list the GA under April 2026. A Microsoft identity plane, not a cross-vendor standard.

What would change the picture

Signals we are watching for. Our own reading of where the thread could go: not predictions, and not sourced claims.

  • The IETF OAuth working group publishes the Identity Assertion JWT Authorization Grant (ID-JAG) as an RFC Would suggest: enterprise-managed agent access getting a settled standard rather than a draft
  • A second identity provider besides Okta ships support for MCP Enterprise-Managed Authorization Would suggest: central IdP control of agent tool access becoming vendor-neutral
  • An MCP spec release adds a standard way for servers to authenticate agents acting without a present user Would suggest: agent identity moving from roadmap item to interoperable protocol
  • A cloud identity product documents issuing agent identities that another vendor's platform accepts across org boundaries Would suggest: cross-organization agent trust working in practice, not just inside one vendor

From the Drops

AgentsDocumented

Google Cloud's IAM Helper gives agents skills to fix permissions, with human sign-off

Google says IAM Helper Agent Skills, built on Google-managed MCP tools, let agents diagnose 403 errors, test policy changes against 90 days of logs and request time-bound access. Policy changes pause for human confirmation.

Why it matters: Agents that hit permission walls tend to get over-permissioned. Google's design keeps diagnosis automatic but routes access changes to a person, by risk tier.

Google Cloud · Oct 27
From Drop #051 · Wed, Oct 28 · Morning
AgentsDocumented

LangChain shares the five parts of its internal company agent harness

LangChain says its sales, engineering and marketing agents live in Slack, keep global and per-user memory, run code in sandboxes, and often run on schedules or events. Email tools that act for a user work only in DMs.

Why it matters: LangChain calls identity the thorniest problem: some tools act for the user, others use fixed credentials, and some actions are limited to approved users.

LangChain · Oct 25
From Drop #047 · Mon, Oct 26 · Morning
AgentsDocumented

Argus, an open-source security platform, keeps its AI agents propose-only

Its maker says Argus's AI agents investigate with read-only access and can only propose actions; every change passes one broker with approvals, dry runs, rollback and a kill switch. Autonomous response is off by default.

Why it matters: A concrete pattern for letting agents near production: propose-only agents, reversible actions and hourly caps. The HN post drew 27 points.

Argus · Oct 24Hacker News · Oct 24
From Drop #045 · Sun, Oct 25 · Morning
AgentsShipping

Bayer's 22-agent decision engine answers about 80% of questions without an engineer

AWS says Bayer Crop Science's Agentic Decision Engine routes users' questions to 22 specialist agents in production. A workflow-failure diagnosis that took over an hour now takes under 10 minutes, it says.

Why it matters: The lessons are concrete: scope tools per agent, define identity at every hop, and alarm on failed tasks, not just on HTTP errors that look like successes.

AWS Machine Learning Blog · Oct 23
From Drop #043 · Sat, Oct 24 · Morning
AgentsDocumented

NVIDIA's OpenShell agent sandbox reaches 0.1 and draws 451 points on Hacker News

OpenShell's repo says it confines each agent with kernel-level policy on files, system calls and network, adds credentials only to requests for approved endpoints, and uses formal verification to hold risky policy changes for human review.

Why it matters: It is an open-source, Apache-2.0 way to give agents real tools without handing them secrets. NVIDIA says Jensen Huang described it in Astana as a way to contain AI agents.

GitHub · NVIDIA/OpenShellHacker News · Oct 22NVIDIA · Oct 23
From Drop #042 · Fri, Oct 23 · Evening
AgentsAnnounced

1Password for Agents signs AI agents into accounts without showing them passwords

The Verge reports an agent verifies itself with a unique key, you approve each sign-in on your own device, and 1Password fills the login. Supported agents include Meta Muse, ChatGPT Work and Dots, and Claude Duet.

Why it matters: Handing agents raw credentials is a common shortcut. This keeps a human approval on every sign-in and keeps the password out of the agent's hands.

The Verge · Oct 22
From Drop #040 · Thu, Oct 22 · Evening
AgentsAnnounced

Walmart opens to shopping agents with an MCP gateway and per-agent spending limits

Walmart's Agent Gateway, in beta, lets approved agents search and buy over MCP. Agent Profiles, due next month, require approval for each purchase by default or allow a set spending limit, the Verge and TechCrunch report.

Why it matters: While Amazon blocks shopping agents, Walmart's terms say its returns process applies even when an agent doesn't act as intended, and agents that break the rules get blocked.

TechCrunch · Oct 21The Verge · Oct 21
From Drop #039 · Thu, Oct 22 · Morning
AgentsDocumented

AWS and Keyfactor publish an X.509 identity blueprint for MCP agents

AWS notes MCP has no built-in authentication standard and shows signed request envelopes, user-signed delegations, RFC 8693 audience-scoped tokens and live OCSP revocation, with source code.

Why it matters: Without agent identity, AWS warns, any component could impersonate an agent; this shows how to prove which agent acted for which user, and revoke it quickly.

AWS ML Blog · Oct 20
From Drop #037 · Wed, Oct 21 · Morning
AgentsResearch

Preprint: a tool gate blocked every protected action agents wrongly requested

Researchers report that on invalid-proof cases Nemotron and Llama requested protected actions in 52.1% and 54.2% of trials, yet a deterministic tool gate committed none. A valid proof from a compromised signer still passed.

Why it matters: Check what agents execute, not only what they ask for: enforcement at the tool held, but the authors note proof validity is not factual truth.

arXiv · Oct 20
From Drop #036 · Tue, Oct 20 · Evening
AgentsResearch

Preprint lays out a zero-trust architecture for agent-to-agent communication

The authors survey threats like agent impersonation and message interception, then propose decentralized identifiers with task-scoped verifiable credentials, post-quantum TLS, signed CBOR envelopes and context-aware monitoring.

Why it matters: Scoped, least-privilege identity for agents that talk to each other is still unsettled. This is an architecture proposal, not a production system.

arXiv · Oct 19
From Drop #033 · Mon, Oct 19 · Morning