Analysis

Okta shipped Agent SSO and got Cross App Access adopted into MCP the same month a GitHub issue was shown to reach CI secrets in Claude Code and Gemini CLI. The delegation standard is arriving faster than the governance around it.

Regulation (EU) 2024/1183 anchors national EUDI Wallet availability to 24 December 2026. Most coverage treats this as a public sector milestone. The obligations that will surprise people fall on relying parties.

Three research teams broke passkey guarantees in August 2026 without touching WebAuthn. The weak points were event logs, sync key custody, and in-session key reuse. Here is what actually changed for your rollout.

Our identity takeaways from Black Hat USA 2026: two independent passkey implementation attacks, a wave of AI agent identity and governance launches, an open source tool for dormant non-human identity trust paths, and insider risk getting AI-native and funded.

We catalogued 86 national digital ID schemes across 51 countries. The patterns that emerge, mobile-first, bank-led, biometric, and wallet-bound, tell you where identity is going and what to build for.

Biometrics are now in nearly every national ID and a growing share of logins, and the law has caught up. BIPA, the EU AI Act, and a wave of US state rules treat biometric identifiers as a special category. Here is what changed and what to do.

Not every national ID is equally trustworthy or equally easy to verify. A practical seven-point checklist for evaluating a country's digital ID before you wire it into onboarding, with the references to do it fast.

Our takeaways from Identiverse 2026 in Las Vegas: AI agent identity moved from theory to roadmap, passkeys turned operational, deepfakes pressured identity verification, and session security took center stage.

AI agents now act on behalf of users, call APIs, and chain tools together. They need identities, scopes, and audit trails, and almost no existing IAM stack was designed for them.