Agent Identity Is a Product Before It Is a Standard

Two Announcements, Two Days Apart

On August 24, Okta made Agent SSO generally available, folding the Cross App Access protocol into the single sign-on product it sells to more than 20,000 customers and charging nothing additional for it.¹ Two days later the company reported second-quarter fiscal 2027 results: revenue of $805 million, up 11 percent year over year; subscription revenue of $793 million; remaining performance obligations of $4.86 billion against a consensus near $4.70 billion; and adjusted earnings of $1.05 per share where analysts had modeled $0.97. The stock rose roughly 20 percent in extended trading, and management pointed at demand for tools to secure AI agents as a driver.²

Buried in the product announcement was a number more consequential than the earnings beat. Okta’s own survey work found that 34 percent of organizations apply the same security controls to AI agents that they apply to human employees.³ The figure is vendor-fielded, and a reader should discount it accordingly. Even discounted heavily, it describes a large population of enterprises running autonomous software against systems of record without extending the access model that governs everyone else who touches those systems.

The signal Capital markets have concluded that agent identity is a durable spending category. That conclusion is about revenue, not about control. A security leader reading the same week’s news is being asked to buy a control plane whose governing standard is still a draft concept paper.

---

The Principal Is Not the Actor

A service account has a durable identity, credentials that rotate on a schedule, and a scope bounded by the workload it serves. When it authenticates, the question being answered is narrow. Is this the billing batch job, and may the billing batch job read the billing tables? The answer holds for the life of the account.

An agent has identity, credentials, and scope as well. What it does not have is a stable relationship between them. The same coding assistant may act for one engineer on a refactor at 10:03 and for a different engineer on a deployment at 10:04, with different downstream access appropriate to each. The identity that authenticates is constant. The authority it should carry is not, and nothing in the conventional model expresses that difference.

The mismatch concentrates at one place: the delegation chain. When an agent invokes a second agent, which calls a tool, which reaches a database, the question an incident responder needs answered is not which credential was presented. It is whose authority the action was taken under, and whether that authority was ever granted. OWASP placed exactly this at ASI03 in its Top 10 for Agentic Applications, published in December 2025—identity and privilege abuse, covering inherited permissions during delegation, cached credentials, and confused-deputy patterns in which a lower-privileged agent induces a higher-privileged one to act on its behalf.⁴ Three of the first four entries on that list turn on identity, tooling, and delegated trust rather than on model behavior.

Six national cybersecurity agencies arrived at a similar reading. On May 1, 2026, CISA, the NSA, and the cyber centers of Australia, Canada, New Zealand, and the United Kingdom jointly published Careful Adoption of Agentic AI Services, the first coordinated multi-government guidance aimed specifically at autonomous agents. Its five risk categories lead with privilege escalation and close with accountability opacity, and its most operationally demanding recommendation is cryptographically anchored agent identity carrying short-lived credentials.⁵

Note that the agencies did not recommend avoidance. Instead, the title is careful adoption, and the argument underneath it is that agentic systems are worth deploying when accountability is architected in rather than retrofitted after the first incident.

---

Where the Chain Breaks

The technical answer that has emerged is less exotic than the problem sounds. Rather than issuing an agent a standing credential and hoping the audit log is legible later, the invoking human’s identity and the acting agent’s identity both travel inside the token. In the OAuth token-exchange pattern that Cross App Access implements, the human occupies the subject claim and the agent occupies the actor claim, producing a chain rather than a single anonymous principal. Tokens are short-lived, scoped to a named audience, and issued for one hop, so that when an agent hands work to another agent the second never inherits more authority than the first held.⁶

Three distinct identity planes are in play, and collapsing them into a single credential is the most common architectural failure in production agent deployments.

The credential lifetime question is not new and has been documented for years. The OWASP Non-Human Identities Top 10 leads with improper offboarding and includes over-privileged identities, long-lived secrets, and identity reuse—a description of how most machine credentials are actually provisioned, agents or otherwise.⁷ What agents change is the blast radius and the speed. A leaked token that expired ninety seconds ago is a non-event. The same token with a one-year life is a campaign, and an autonomous consumer of that token can exercise it thousands of times before a human notices anything unusual.

“granting them access to enterprise systems shouldn’t require trading away security or visibility”

— Ric Smith, President of Products and Technology, Okta, August 24, 2026

---

Three Departures From the Service Account Model

A security leader who has run a non-human identity program for five years will read the preceding section and conclude that none of it is new. That reading deserves a fair hearing because it is substantially correct. Token exchange, workload attestation, and just-in-time credential issuance all predate the current wave. The confused deputy was described in 1988. Over-privileged service accounts are the most reliably recurring finding in the history of access audits. NIST endorses the continuity directly: the NCCoE concept paper proposes to demonstrate how existing identity and authorization standards extend to agents rather than to invent a parallel framework.⁸

Three things do change, and only the last of them is structural.

The first is that the call graph cannot be enumerated in advance. When a low-privilege service calls a high-privilege one, that path was written by someone, committed to a repository, and is available for review, threat modeling, and diffing when it changes. An agent selects its tools at runtime from model output. There is no static call graph to inspect, which undermines the assumption beneath most authorization design—that the set of reachable paths is knowable before production.

The second is that authority binds at invocation rather than at provisioning. A service account’s correct privilege is settled at design time and stays correct until someone deliberately changes it. An agent’s correct privilege depends on who asked and what they asked for, and it changes with every request. Entitlement review compares granted permissions against a stable job function, and there is no stable job function here to compare against.

The third has no clean precedent. In short, untrusted input reaches the control path. To exploit the classic service-to-service confused deputy, an attacker generally has to compromise the calling service. To exploit the agent equivalent, an attacker places text where the agent will read it—a support ticket, a shared document, a code comment, a web page—and the agent redirects itself while behaving exactly as engineered. OWASP ranks this first among agentic risks as goal hijack, and its framing is blunt about the cause: the agent cannot reliably distinguish instruction from data.⁴ Nothing in the enterprise perimeter was breached. Correct RBAC on both services does not address it, because no authorization decision was violated.

Why this matters for identity The first two departures are extensions of an existing discipline and can be managed as such. The third is not, and it changes what identity controls are for. Once goal hijack is assumed to be possible rather than preventable, the only remaining question is how much authority the hijacked agent was holding when it happened, which makes token scope and lifetime the last line of defense rather than an audit convenience.

---

What a CISO Is Actually Buying

These are not competing versions of the same product. They sit at different architectural layers and are priced on different bases, which means a feature-grid comparison will mislead the procurement team running it.

Okta bundles connection-layer identity into core SSO at no incremental charge and sells governance separately through Okta for AI Agents, generally available since May 2026, which handles discovery of unregistered agents, owner assignment, certification, and deactivation.¹ Microsoft registers agent identities in Entra and extends conditional access, identity protection, and governance to them, but reaching those capabilities requires Microsoft Agent 365 rather than an existing Entra or Microsoft 365 plan.⁹ Agent 365 has been generally available since May 1, 2026, at $15 per user per month standalone or bundled inside a Microsoft 365 E7 suite at $99; the Entra Suite does not include it.¹⁰ Two changes in the four months since launch matter to anyone modeling the cost. Microsoft formalized the prerequisites on June 1, 2026, so the standalone license now requires an E5-class base, or E3 paired with both the Defender and Purview suites, with separate qualifying paths for frontline and smaller businesses.¹¹ The July 1 Microsoft 365 price update then raised E5 to $60, which moves the arithmetic underneath E7 rather than the suite price itself.¹² Amazon takes the platform route, with AgentCore Identity providing identity-aware authorization and refresh-token vaulting as part of a consumption-priced agent runtime, and AgentCore Policy intercepting tool calls at the gateway against rules compiled to Cedar.^13,14

Two procurement considerations follow. The first is that the governance line is the flattest part of the bill and the least informative. One Agent 365 license covers every agent a licensed person owns, sponsors, or manages, so a tenfold rise in agent population does not move it.¹¹ Everything around it moves. The prerequisite stack is an E5-class entitlement per covered user, and construction and execution meter separately through Copilot Studio credits and Foundry consumption.¹¹ The other two vendors invert the shape rather than escape it. In each case the published number describes the part of the estate that does not grow.

Second, and more important for a security program, every one of these products has a coverage boundary at exactly the place the risk concentrates. Okta’s own framing names three populations an enterprise must account for at once: agents it built, agents embedded in software it purchased, and agents employees deployed without central approval.¹ The third population is the one no identity provider, productivity suite, or cloud platform can register by default, because the enterprise did not put it there.

---

Where the Capital Went

The strategic behavior is easier to read than the marketing. Palo Alto Networks completed its acquisition of CyberArk on February 11, 2026, for $2.3 billion in cash and 112 million shares, closing a transaction announced the prior July at roughly $25 billion and explicitly framed around securing human, machine, and agentic identity as a platform pillar.^15,16 Okta bundled its connection-layer capability into a product 20,000 customers already own, which is what a vendor does when it wants to establish a protocol as the default rather than monetize it early. Microsoft created a discrete SKU, which is what a vendor does when it believes the capability is separable and the demand is inelastic. Amazon put it in the runtime and charged for consumption.

What these postures share is an assumption that identity is the control plane for agentic AI. What they disagree about is where enforcement physically happens, and that disagreement is not cosmetic. An identity provider enforces at the point of connection, before the agent reaches the application, which is early enough to prevent a bad grant and too early to see what the agent does with a good one. An agent platform enforces at the gateway, on every tool call. That is the richest view of the three, and it covers only the traffic that actually routes through the gateway. A productivity platform enforces at its own tenant boundary, which is comprehensive inside that boundary and blind outside it. An enterprise that buys all three has not bought defense in depth; it has bought three partial views and a reconciliation problem, unless someone has decided in advance which layer is authoritative when they disagree.

Set those choices against the standards calendar and the mismatch is stark. NIST’s Center for AI Standards and Innovation launched its AI Agent Standards Initiative on February 17, 2026, naming agent authentication and identity infrastructure among its pillars.¹⁷ The NCCoE concept paper closed public comment on April 2 and will inform a draft project description.⁸ Nothing normative has published. Cross App Access has been incorporated as the enterprise-managed authorization extension for the Model Context Protocol and the underlying grant remains an IETF draft.^1,6 Products reached general availability well ahead of the specification they implement.

The regulatory forcing function also weakened this summer rather than strengthened. The EU’s Digital Omnibus on AI, given final Council approval on June 29, 2026, deferred high-risk obligations under the AI Act from August 2, 2026 to December 2, 2027 for stand-alone Annex III systems and to August 2, 2028 for AI embedded in regulated products, while leaving the Article 50 transparency obligations to take effect on the original date.¹⁸ Security leaders who had built a control roadmap around an August deadline now have sixteen additional months. The deadline moved. The exposure did not.

---

A Floor, Not a Roadmap

Maturity models are useful for planning and useless in an incident. What follows is a floor—the set of conditions below which an agent deployment is not defensible, regardless of which vendor’s console the organization ends up in. Each is stated as a test rather than a policy, because a policy that has never been exercised is a document, not a control.

1. Registration precedes governance. Produce an inventory that includes agents embedded in purchased software and agents running in developer environments, not only the ones the platform team built. The test is a count from two independent discovery methods that agree within a tolerance you set in advance.

2. Every agent has a named human owner. Not a team, not a distribution list. The test is whether owner departure triggers an automated review, and whether that automation has ever actually fired.

3. No standing credentials in an agent execution context. Short-lived, audience-scoped tokens issued at point of use. The test is adversarial: compromise a test agent’s context, enumerate what is obtainable, and measure how long it stays valid. Report the median credential lifetime across the agent estate as a metric with a trend line.

4. The delegation chain is reconstructable. For a representative multi-agent workflow, produce a trace showing which human authorized the task, which agent acted, what authority passed across each hop, and where it narrowed. Where the trace cannot be assembled, accountability is unresolvable no matter what the policy asserts. This is the requirement most estates fail, and it fails silently.

5. A kill switch with a measured time-to-effect. Individual agent, agent class, and full estate, each timed. The gap to look for is agents running inside SaaS platforms and third-party tools where the orchestrator’s kill switch does not reach.

Report non-human identity governance separately from human identity governance. A blended access-review figure conceals a poor machine posture behind good human hygiene, and improper offboarding—the failure that leads the published non-human identity risk list—is precisely what the blended number hides. The broader control set for agent-authored change, including provenance, isolation, and evidence preservation from ephemeral runtimes, is developed at length in the agentic SDLC framework; the identity domain there is a subset of what this floor requires and a useful place to start on the engineering side.

---

The Reconstruction Test

The purchase decision in front of most security organizations this quarter is real, and there is no reason to defer it while waiting for NIST to publish. But the product is not the control, and a signed order form for agent governance proves nothing about whether authority can be traced through a chain of autonomous actions to a human who granted it. That reconstruction is the thing auditors will eventually ask for, incident responders will need under pressure, and no vendor can supply on an enterprise’s behalf. Run the trace on one real workflow. Whatever the answer, it will tell a CISO more about the organization’s actual posture than any feature comparison will.

---

References

1. Okta, “Okta brings first-class identity to AI agents with Agent SSO,” press release, August 24, 2026.
2. Okta, “Okta Announces Second Quarter Fiscal Year 2027 Financial Results,” August 26, 2026; see also Jordan Novet, “Okta shares surge on fiscal second-quarter results,” CNBC, August 26, 2026.
3. Okta, AI Agents at Work 2026, cited in Okta press release, August 24, 2026. Vendor-fielded survey.
4. OWASP Gen AI Security Project, OWASP Top 10 for Agentic Applications (Version 2026), December 2025.
5. Cybersecurity and Infrastructure Security Agency, National Security Agency, ASD ACSC, Canadian Centre for Cyber Security, NCSC-NZ, and NCSC-UK, Careful Adoption of Agentic AI Services, May 1, 2026.
6. Okta, “Securing the agentic enterprise: The blueprint in practice,” June 1, 2026; Internet Engineering Task Force, “OAuth Identity Assertion Authorization Grant,” Internet-Draft.
7. OWASP, Non-Human Identities Top 10, 2025.
8. Harold Booth, Bill Fisher, Ryan Galluzzo, and Joshua Roberts, Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization, National Cybersecurity Center of Excellence concept paper, February 2026. Public comment closed April 2, 2026.
9. Microsoft, “What are agent identities?” Microsoft Entra Agent ID documentation, Microsoft Learn, June 2026.
10. SAMexpert, “Agent 365 Licensing: What It Covers and Costs,” June 2026. Secondary analysis of Microsoft’s published pricing.
11. “Microsoft Agent 365 — Pricing and Licensing Guide,” A Guide to Cloud and AI, list pricing sourced from Microsoft pricing pages as of August 2026. Secondary licensing analysis; prerequisites formalized June 1, 2026.
12. Microsoft, “Microsoft 365 Pricing and Packaging Updates,” Microsoft Licensing Resources, pricing effective July 1, 2026.
13. Amazon Web Services, “Amazon Bedrock AgentCore is now generally available,” October 13, 2025.
14. Amazon Web Services, “Amazon Bedrock AgentCore now includes Policy (preview), Evaluations (preview) and more,” December 2, 2025.
15. Palo Alto Networks, “Palo Alto Networks Completes Acquisition of CyberArk to Secure the AI Era,” February 11, 2026.
16. Palo Alto Networks, Form 10-Q for the quarterly period ended January 31, 2026, Note 16, Subsequent Events, U.S. Securities and Exchange Commission.
17. National Institute of Standards and Technology, Center for AI Standards and Innovation, “AI Agent Standards Initiative,” February 17, 2026.
18. Council of the European Union, final approval of the Digital Omnibus on AI, June 29, 2026; see also Gibson Dunn, “EU AI Act Omnibus Agreement — Postponed High-Risk Deadlines and Other Key Changes,” May 2026.