Agent identity just got a protocol, which is the easy half

On August 24, 2026, Okta made Agent SSO generally available and confirmed that Cross App Access, the OAuth extension it designed, had been adopted as the official Enterprise-Managed Authorization extension for the Model Context Protocol. Two and a half weeks earlier, Novee Security showed at Black Hat that opening a GitHub issue was enough to reach CI workflow secrets in Anthropic's and Google's own coding-agent repositories.

Read those together and you get the state of agent identity in 2026: the delegation protocol is close to settled, and the operational discipline around it is not close to anything.

What actually shipped

Agent SSO registers an AI agent as a first-class identity in Okta's Universal Directory and issues short-lived, governed tokens instead of the static API keys agents normally carry. Admins grant and revoke agent access through the same workflows they use for employees. It is included in core Okta SSO at no extra cost, which matters more than the feature list, because pricing is what decides whether a control gets deployed or piloted.

Cross App Access is the more consequential piece. It is a vendor-neutral extension that lets identity follow an agent as it moves between applications, and its adoption into the MCP authorization spec means the pattern is no longer one vendor's. Alongside MCP's OAuth 2.1 and PKCE model and Microsoft Entra Agent ID reaching general availability, the ecosystem now has a common answer to "how does an agent prove who it is acting for."

That answer is roughly the one OAuth has always given, extended to a delegation chain of more than two parties. Which is correct, and unglamorous, and exactly what should have happened.

Why the standard is the easy half

Standards solve for the protocol. They do not solve for the four things that actually break agent deployments.

Untrusted input is now executable. A GitHub issue, a pull request title, a repository instruction file, a support ticket: these are inputs from anyone, and pointing an agent at them inside a runner that holds credentials makes them code. Gemini CLI before 0.39.1 carried a CVSS 10.0 command injection. Claude Code through 2.1.163 carried an API key exfiltration path. Both were fixed. The class is not fixed, because the class is architectural. Our news brief has the mitigations.

Session identity gets lost in the middle. HashiCorp's Terraform MCP Server shipped a CVSS 10.0 flaw where, in stateless HTTP mode, one user's Terraform token could serve a later user's request. An MCP server between an agent and a privileged API is a credential broker, and a broker that confuses two callers grants access that looks perfectly legitimate to the API. Standardizing the token format does nothing about this. See the brief on cross-tenant token reuse.

Nobody owns the agent. Every functioning non-human identity program starts with an owner, an expiry, and a review. Agents get created by developers in the course of building something, inherit whatever credential was nearest, and appear on no access review. Okta's own research says only 34 percent of organizations apply human-grade security controls to agents. The other 66 percent do not have a protocol problem.

Scope is aspirational. An agent with a scoped token that can call a tool that has a broad token has a broad token. Delegation chains inherit the widest permission in the chain unless something actively narrows them, and narrowing requires knowing what the agent needs, which requires having watched it run.

What to do before the agents reach production

1. Give every agent an owner and an expiry. Treat it as a service account with a human accountable for it. If you cannot name the owner, the agent should not have a credential.
2. Kill static keys. Short-lived tokens issued by the identity provider are the entire point of Agent SSO and Entra Agent ID. An API key in a config file has no expiry, no revocation, and no audit trail worth reading.
3. Separate untrusted-input passes from credentialed passes. In CI, this means the agent job and the deploy job do not share a runner. Run agents in read-only sandboxes, without sudo, as the final pipeline step.
4. Scope tokens down to the single repository, dataset, or action. Then audit the tools the agent can call, because your scope is only as narrow as the widest thing downstream.
5. Log the delegation chain, not just the call. "Agent X called API Y" is not an audit trail. "User A asked Agent X, which called Tool Z as User A, at time T" is. Cross App Access makes this expressible. Emitting and retaining it is your job.
6. Put agents in access reviews. If your quarterly access certification does not list agents, it is certifying a shrinking fraction of what can reach your data.

The honest read

Agent identity standardization in 2026 went faster than anyone expected, and faster than the machine identity work that preceded it, largely because the vendors had a working template in OAuth. That is genuinely good news, and Cross App Access landing in MCP rather than staying proprietary is the single best outcome available.

But every incident this month came from operations, not protocol. A CI runner that shared secrets with an untrusted-input job. A broker that lost track of whose token it held. Credentials with no owner. Those are the same failures that have defined non-human identity for a decade, arriving faster because agents are created faster.

The protocol is the easy half. Start the governance now, while your agent count is still small enough to count.

Related reading

• Okta ships Agent SSO
• Agentic AI identity is the next frontier
• What is non-human identity
• Agentic identity, glossary