Published: October 4, 2026 | Category: Technology | By Mahesh
"Traditional Identity Systems Cannot Prove Which Human Authorized This"
Every protocol Depth Grid has covered in this series solves a specific, bounded problem. MCP lets an agent reach a tool. A2A lets two agents talk. AP2 lets an agent spend money with a cryptographic paper trail. None of them answer a more basic question sitting underneath all three: when an agent shows up claiming to be a specific entity acting on a specific person's behalf, how does anyone on the other end actually verify that claim is true. A comprehensive 2026 academic survey of the agent identity landscape states the current state of that question in a single, direct sentence: no single standard spans the full agent identity lifecycle, and the gaps are not random.[1] Depth Grid's coverage so far this series has traced the protocol wars deciding the agentic web, MCP's own security vulnerabilities, and the payments layer letting agents spend without a human present. This piece covers the layer underneath all three: the unsolved question of agent identity itself.
Why Identity Is the Gap MCP and A2A Quietly Left Open
Coverage of enterprise identity security at RSAC 2026, the industry's largest security conference, names the structural problem directly: traditional identity systems cannot prove which human authorized an AI-initiated action, and software-only controls are vulnerable to impersonation or replay attacks.[2] The same reporting cites industry data showing 87 percent of organizations see rising risks from AI vulnerabilities, while most lack foundational AI security practices to address them.[2] This is precisely the gap Depth Grid's earlier reporting on MCP's security vulnerabilities found exploited directly: the Oura Ring trojan incident covered in that piece worked specifically because the compromised MCP server could not be cryptographically distinguished from the legitimate one a user actually intended to trust, an identity verification failure as much as a code-level vulnerability.
A Microsoft taxonomy of agentic AI failure modes, cited in a 2026 global AI safety research summary, frames identity as the structural precondition underneath the most consequential agent failure categories, impersonation, lost transparency, and permission escalation, rather than as one risk among many equally weighted concerns.[3] That framing matters because it explains why this gap has proven so much harder to close than the tool-access and payment-authorization problems MCP and AP2 solved relatively cleanly: identity is not a single transaction to standardize, it is a continuous, multi-step lifecycle spanning how an agent is created, how it proves who it is at any given moment, how that proof travels across organizational boundaries it was never originally designed for, and how its authority can be revoked the instant something goes wrong, each of which has attracted its own separate, only partially compatible, technical proposal.
What the Academic Survey Actually Found
The arXiv survey on AI identity standards and gaps maps the current landscape with unusual precision for an academic paper, and its findings deserve to be read in full detail because they explain exactly where the gap sits rather than simply asserting one exists. For authentication specifically, the paper identifies WIMSE, Workload Identity in Multi-cloud and Service Environments, built on the existing SPIFFE standard, as the most mature available option, providing ephemeral, attestation-bound workload credentials at scale.[1] That maturity is real but narrow: WIMSE solves how an individual agent proves its own machine identity within a known infrastructure boundary, not the considerably harder problem of how that same agent's authority should be recognized once it crosses into a different organization's infrastructure entirely, interacting with a second company's agents or systems that have no prior relationship with the first.
For that cross-boundary problem specifically, the same survey notes emerging work, including an IETF draft called the Agent Authorization Envelope, attempting to close the gap by layering World Wide Web Consortium Decentralized Identifiers and Verifiable Credentials on top of the existing workload-identity foundation, precisely so that a relying party with no direct relationship to an agent's home environment can still independently evaluate its authorization.[4] The paper's own stated conclusion, echoed independently by the Cloud Security Alliance's own 2026 research, converges on the same honest diagnosis: the industry is converging on a layered model rather than a single winning standard, OAuth 2.1 for tool-access authorization, signed capability declarations for agent-to-agent discovery, workload attestation or decentralized credentials for cross-boundary trust, and separate vendor identity platforms layered on top for lifecycle governance, a genuinely more fragmented picture than the relatively clean MCP-versus-A2A story this series' pillar article was able to tell.[4]
Four Competing Technical Approaches, None Dominant
| Approach | Solves | Status |
|---|---|---|
| SPIFFE / WIMSE | Workload-level machine identity | Most mature, limited to known infrastructure |
| W3C DIDs / Verifiable Credentials | Portable, cross-boundary identity | Active IETF draft work, not yet adopted broadly |
| OAuth 2.1 extensions | Tool-access authorization | Widely used but not agent-native by design |
| Hardware-backed dual-identity (Yubico/Delinea model) | Binding high-risk actions to a verified human | Live vendor integrations, not a formal open standard |
Sources: arXiv agent identity survey; Cloud Security Alliance research note; BiometricUpdate RSAC 2026 coverage, 2026.[1][4][2]
The academic literature in this space has grown large enough in 2026 to itself illustrate the fragmentation problem it describes. Separate, independently developed proposals, AgentDID, the Agent Identity URI Scheme, the Agent Identity Protocol built specifically to span both MCP and A2A, and the Agent Name Service, each propose a genuinely different technical mechanism for solving overlapping pieces of the same underlying problem, and none has yet achieved the kind of broad, cross-vendor adoption that let MCP consolidate the tool-access layer so decisively.[5] Google's own A2A protocol does include a lighter-weight approach to agent-to-agent discovery and authentication across organizational boundaries, but the same survey notes it stops short of a complete, production-ready identity lifecycle standard, covering discovery without fully resolving the harder revocation and cross-boundary trust questions.[1]
Singapore and the First Real Regulatory Move
While technical standards bodies continue iterating without consensus, Singapore's Cyber Security Agency moved first and most concretely on the regulatory side. Its October 2025 Addendum on Securing Agentic AI takes a direct cybersecurity angle on exactly this gap, formally designating identity spoofing and impersonation as threat category T9, and requiring organizations to maintain a trusted agent registry and authenticate agents using verifiable credentials with short-lived OAuth 2.0 or OpenID Connect tokens.[1] Singapore followed with a further update in June 2026, finalizing voluntary controls recommending the same trusted-registry and verifiable-credential approach, alongside explicit human verification requirements for high-impact agent actions.[6]
The United States, by contrast, has no comparable federal AI identity legislation as of this piece's publication, though the National Institute of Standards and Technology has begun concrete preparatory work: NIST's National Cybersecurity Center of Excellence opened a formal project in February 2026 specifically titled "Accelerating the Adoption of Software and AI Agent Identity and Authorization," and NIST separately announced its Control Overlays for Securing AI Systems initiative in 2025, with specific deliverables expected through 2026.[7] Research cited in a 2026 arXiv paper also documents that China has begun its own distinct approach entirely, developing what researchers describe as a national agent-identity layer built around split-knowledge binding, a cryptographic technique designed to let agents remain individually accountable without a single central authority holding complete, unilateral control over every agent's identity data, a notably different governance philosophy than either Singapore's registry-based model or the decentralized, standards-body-driven approach favored in the United States and Europe.[5]
What Hardware-Backed Accountability Actually Looks Like in Production
With no single open standard yet dominant, several vendors have moved ahead with proprietary, interoperable solutions designed to be adopted incrementally rather than waiting for industry-wide consensus to emerge. The clearest example demonstrated at RSAC 2026 combines IBM's own WatsonX AI orchestration, Auth0's identity flows using the Client-Initiated Backchannel Authentication standard, and Yubico's hardware-backed YubiKey authentication into a single framework allowing AI agents to operate autonomously for routine tasks while requiring cryptographically verified human approval specifically for high-stakes actions.[2] Yubico and Delinea separately announced a partnership integrating Yubico's hardware-attested Role Delegation Tokens directly into Delinea's own platform alongside StrongDM's runtime authorization engine, explicitly designed, in the words of the companies' own joint statement, to create a trusted chain of control that ensures every high-risk action performed by an AI agent can be traced back to a verified human decision.[2]
This pattern, combining hardware-backed credentials with software-level orchestration and runtime authorization, maps directly onto the same core tension Depth Grid's earlier reporting on AI agent payment protocols identified in the Human Not Present payment category: a system designed to let an agent act autonomously for routine, low-stakes decisions while still requiring verifiable human accountability specifically for the decisions carrying genuine consequence. Major cloud platforms have already begun operationalizing comparable identity principles directly into their own agent infrastructure: Google Cloud's Vertex AI Agent Engine secures agents through per-agent identity principals bound to trusted runtime environments specifically so a stolen credential cannot be reused outside its original context, while Alibaba Cloud's own agent identity service provides end-to-end identity management spanning an agent's entire lifecycle from initial prototype through full production deployment.[3]
What This Means for Anyone Deploying Agents Today
Give every agent its own distinct, verifiable credential, never a shared one. Current industry guidance on securing non-human identities states this rule directly and treats it as the single most commonly violated baseline practice: every agent should carry a distinct, verifiable credential, ideally a short-lived token issued on demand, rather than a static key shared across multiple agents or baked permanently into an environment variable, since a shared credential makes it structurally impossible to trace a specific action back to the specific agent, and the specific human authorization, that actually produced it.[8]
Maintain a trusted agent registry rather than relying on ad hoc trust decisions. Following Singapore's own regulatory model as a practical template regardless of jurisdiction, an organization deploying multiple agents should maintain a formal, centrally managed registry of every agent authorized to act on its behalf, with each entry tied to verifiable credentials and a clearly defined authorization scope, rather than allowing individual teams to stand up agents and grant them access on a case-by-case, undocumented basis.
Reserve hardware-backed human verification specifically for high-stakes actions, not every agent decision. Given that the production implementations covered in this piece consistently apply cryptographic human verification only to high-risk actions while allowing routine tasks to proceed autonomously, an organization should map its own agent-initiated actions by consequence severity first, then apply the heaviest, most friction-adding identity controls specifically to the subset of actions where an error or impersonation would actually cause meaningful harm, rather than applying uniform friction across every agent interaction regardless of stakes.
Common Questions
This analysis is editorial commentary based on publicly available sources cited above. It is not security, legal, or investment advice. Standards status, regulatory details, and vendor implementations cited reflect information available as of publication and change frequently as this landscape evolves; verify current guidance directly with NIST, the Cyber Security Agency of Singapore, and relevant standards bodies before making security architecture decisions based on this information.
Sources
- arXiv, "AI Identity: Standards, Gaps, and Research Directions for AI Agents," arXiv:2604.23280, 2026. Link
- BiometricUpdate, "AI Agent Identity and Next-Gen Enterprise Authentication Prominent at RSAC 2026," March 2026. Link
- arXiv, "The 2026 Singapore Consensus on Global AI Safety Research Priorities," citing Microsoft's Taxonomy of Failure Modes in Agentic AI Systems and Google Cloud Vertex AI Agent Engine. Link
- Cloud Security Alliance, "Agentic Identity: Emerging Standards and Security Guidance," September 2026. Link
- arXiv, "SoulAuth: An Actor-native Identity Architecture and Rust Reference Implementation for Humans and Long-lived AI Actors," citing related agent identity research including AgentDID and China's split-knowledge binding research, arXiv:2609.11258, 2026. Link
- Cloud Security Alliance, "Agentic Identity: Emerging Standards and Security Guidance," citing Singapore Cyber Security Agency June 2026 Addendum update, September 2026. Link
- NIST National Cybersecurity Center of Excellence, "Accelerating the Adoption of Software and AI Agent Identity and Authorization," Concept Paper, February 2026. Link
- DEV Community, "AI Agent Identity: Securing Non-Human Identities in 2026," August 2026. Link
Read More on Depth Grid
- The Protocol Wars Nobody's Watching Will Decide Who Controls the Agentic Web
- Researchers Found a Flaw in 150 Million MCP Downloads. Even Anthropic's Own Server Had It.
- Google's New Protocol Lets AI Agents Buy Things With No Human Present
- Cyber Insurance for Small Businesses: Coverage, Cost and Requirements in 2026
Article by Mahesh | Depth Grid
Discussion (0)
Comments are disabled for this post.