{"slug":"a-protocol-for-answering-who-authorized-this-agent","citations":[{"url":"https://www.proof.com/blog/the-fraud-files-agents-impersonation-and-the-identity-layer-nobody-built-july-2026","committed_hash":"sha256:513ef3a855c7764a1f529d3065c6e2400abf38c9500e8403da302e892cd1ab8d","committed_hash_short":"sha256:513ef3a8…2cd1ab8d","mime_type":"text/html","committed_at":"2026-07-27T09:00:18.576372+00:00","content_snapshot":"\nThe Fraud Files - July 2026 | Proof | Proof\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
New
Proof launches identity infrastructure for the agentic internet
Introducing Identify
Learn More
Notarize now
Log in
\n \n
Back
Talk to sales
Get Proof
Blog
\n\n
The Fraud Files: Agents, Impersonation, and the Identity Layer Nobody Built | July 2026

The Fraud Files: Agents, Impersonation, and the Identity Layer Nobody Built | July 2026

AI agents are transacting on behalf of real people, on real payment rails, right now. The fraud ecosystem built around that fact is already operational, and this month's headlines show exactly how the attack surface is forming.
\"\"
Ray Hayes
July 13, 2026
\"The

AI agents are transacting on behalf of real people, on real payment rails, right now. The fraud ecosystem built around that fact is already operational, and this month's headlines show exactly how the attack surface is forming.

Prompt injection governs most agentic AI risk

OWASP's 2026 State of Agentic AI Security, published this month, reads very differently from its 2025 predecessor. The 2025 edition cataloged plausible threats. The 2026 edition catalogs CVEs, vendor advisories, and breach reports tied to nearly every category of agentic risk. One technique is at the center of most of them: prompt injection. OWASP maps prompt injection to six of the ten categories in its Top 10 for Agentic Applications. 

The root cause is architectural. Large language models treat the system prompt, the user's request, and any text retrieved from external sources as a single token stream. There is no reliable boundary between commands and data. Hostile instructions embedded in a document, a product listing, a calendar invite, or a web page carry the same authority as legitimate operator instructions, because to the model there is no structural difference.

The most concrete illustration of the supply chain exposure came in March, when a backdoored version of LiteLLM sat on PyPI for three hours and accumulated nearly 47,000 downloads. LiteLLM serves as the language model gateway for CrewAI, DSPy, Microsoft GraphRAG, and dozens of other agent frameworks. Every installation during that window pulled in a credential-harvesting package that required no further human direction to operate. 

OWASP's researchers describe the pattern as the "lethal trifecta": an agent that combines access to private data, exposure to untrusted content, and the ability to communicate externally can be turned into an exfiltration tool by a single injected instruction.

Trusted agents are being impersonated at scale

The agents driving legitimate commerce are themselves being spoofed. DataDome's AI Traffic Report, tracking nearly 8 billion AI agent requests across its network in January and February 2026, found that spoofing of recognized agents is widespread. Meta-ExternalAgent saw over 16 million spoofed requests in that two-month window alone. PerplexityBot carried a 2.4% impersonation rate across the same period.

The mechanism is straightforward. Merchants and platforms that accept trusted agent traffic extend preferential treatment or relaxed friction to recognized crawlers. Fraudsters build agents that present themselves as those crawlers to exploit the trust relationship. The agent receives the permissions extended to the legitimate one and uses them to extract pricing data, map inventory, probe for policy weaknesses, or initiate transactions.

This dynamic is not a niche edge case or an emerging concern. It is already operating at machine scale. The challenge it creates for platforms trying to facilitate legitimate agentic commerce is that the credentials being spoofed are behavioral and reputational, not cryptographic. There is no mechanism to verify that the agent presenting a recognized user-agent string actually is that agent.

Agentic payment rails launched with an empty identity slot

On June 10, Mastercard launched Agent Pay for Machines, a multi-rail service enabling AI agents and machines to initiate payments at machine speed, launching with more than 35 named partners across card networks, crypto-native platforms, and payment processors. Visa, Google, OpenAI, and Stripe have their own agentic commerce protocols in production or beta.

Every one of those specifications defers the same question to an entity not named in the document. Google's Agent Payments Protocol (AP2) states in Section 9 that the issuance of trusted identity keys is "a critical area for innovation" and explicitly "out of scope." Anthropic's Model Context Protocol authorization spec notes that the authorization server is "beyond the scope of this specification." Visa's Trusted Agent Protocol defers human identity verification to "context-specific" trust frameworks. 

The pattern is consistent: the rails were designed; the identity layer that should sit beneath them was designated someone else's problem.

The practical consequence is that every agentic transaction on every one of these rails lacks a cryptographic answer to the most basic question a merchant or financial institution should be able to ask: did a verified human actually authorize this?

Fraudulent storefronts are built to intercept agents

Palo Alto Networks Unit 42 published threat research in March documenting what indirect prompt injection against retail agents looks like in practice. The attack scenarios are operationally specific, and they are worth reading closely.

In the gift card theft scenario, a fraudulent deals aggregator site embeds a hidden instruction in its HTML. A shopping agent crawling for discounts ingests the instruction, which reprograms the agent's memory to append an unauthorized gift card to the final cart payload before checkout. The gift card is sent to the attacker's address. If the user's interface shows only a total price, the addition may not surface until the bank statement arrives.

In the returns fraud scenario, a product listing embeds instructions telling the agent to skip the return verification step and trigger an instant refund without a valid shipping confirmation. Unit 42 notes that organized crime groups running bot farms could initiate tens of thousands of fraudulent return events within a single hour, with the potential to deplete a retailer's cash reserves before a human reviewer begins their shift.

The World Economic Forum's 2026 Annual Meeting estimated that by 2028, one in four data breaches could result from AI agent exploitation. Bain projects that agentic AI will handle 15 to 25 percent of all e-commerce volume by 2030. The fraud surface being built right now is proportional to both of those numbers.

Agentic fraud is already a commercial product

At Money 20/20 in October, Nash Ali, head of operational strategy for Experian, told the room plainly: "We're sitting on the precipice now of another explosion in fraud with agentic AI coming our way." He cited FraudGPT, an AI-powered fraud tool available for a $1,400 annual subscription, as evidence that the infrastructure for AI-enabled fraud is already commoditized and commercially available. "It's no longer a human sitting and committing fraud on an individual basis."

The pattern OWASP documents reinforces this directly. In February 2026, the hackerbot-claw package exploited GitHub Actions misconfigurations across open source repositories. In March, it harvested a package maintainer's PyPI publishing token through a compromised CI pipeline and pushed two backdoored versions of a widely used AI framework directly to the package repository. No human direction was required after the initial launch. The fraud operation ran on its own.

Despite this, IBM data cited in OWASP's 2026 report found that only 37% of organizations have a policy in place to detect shadow AI. The regulatory environment is tightening around that gap: DORA requires a four-hour incident notification window, NIS2 requires a 24-hour early warning, and New York's RAISE Act sets a 72-hour reporting clock for frontier model incidents. Organizations are on the hook for agentic AI failures before most of them have even defined what those failures look like.

What these signals mean together

Prompt injection works because agents cannot verify the trustworthiness of the content they process. Impersonation works because there is no cryptographic mechanism to confirm that an agent presenting a recognized identity actually holds it. Agentic payment rails launched without specifying who issues the credential linking a transaction to a verified human. Fraudulent storefronts succeed because agents ingest instructions from poisoned sources with no way to distinguish manipulation from legitimate content. And fraud-as-a-service is thriving because attackers read the same protocol specifications, found the same empty slot, and built tools to exploit it.

The through-line across all five is the same: agentic commerce was built without an identity layer. The rails exist. The agents are transacting. The question of who authorized what, on whose cryptographic authority, with what verifiable chain back to a real human, remains unanswered in every major specification currently in production.

Proof built the identity layer the protocols are missing

Last week, Proof launched x401, an open HTTP protocol that fills exactly this gap. When a server requires identity, it returns a 401 response with an x401 challenge specifying the required credential type and the accepted issuer. The client, whether a browser, an SDK, or an AI agent runtime, presents a cryptographic credential proving that a verified human authorized the action and that the action falls within the scope that human approved.

The credential is Proof ID: a W3C Verifiable Credential issued after IAL2 identity proofing, signed by Proof's WebTrust-audited Certificate Authority, and bound to a key the user controls. When an agent acts, it presents a credential it inherited from the human who delegated to it. The server verifies the chain back to Proof's CA. 

There is no impersonation because the credential is cryptographically signed. 

There is no scope creep because the delegation mandate is encoded in the credential. There is no ambiguity about human authorization because the entire chain is independently verifiable.

x401 is an open protocol. The spec is published and the SDKs are available. The identity layer agentic commerce needs exists today.

\"graphic

Subscribe to our newsletter

Sign up
\n\n

Related Articles

\"\"
Fraud

Title lorem ipsum

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros.
\"\"
Author name
11 Jan 2022
\"\"
Fraud

Title lorem ipsum

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros.
\"\"
Author name
11 Jan 2022
\"\"
Fraud

Title lorem ipsum

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros.
\"\"
Author name
11 Jan 2022
\n\n
\n\n
\"\"
Digital Identity

Your Account Recovery Process Is Your Biggest Security Gap

Stop relying on help desk judgment for account recovery. Learn how identity-first verification closes your biggest security gap and prevents vishing attacks.
\"\"
Kris Singh
July 24, 2026
\"\"
Technology

The Authorization Gap: Why Agentic Commerce Can't Scale Without an Identity Layer

Every major agentic commerce protocol has built serious infrastructure for how authorization records should flow. What none of them has defined is who issues the credentials that make those records trustworthy. We partnered with Liminal to research why this gap exists, why it can't close on its own, and what filling it actually requires.
\"\"
Jessica Howe
July 23, 2026
\"\"
Hiring & Onboarding

What Identity Verification Actually Looks Like for Your Real Candidates

Every conversation about candidate fraud eventually runs into the same concern: we can't add friction for candidates. The hiring market is competitive. Candidates drop off. A bad experience reflects on the employer brand, and the last thing a talent team needs is another step in the funnel that loses real people before they ever get to an interview.
\"\"
Leandra Fishman
July 22, 2026
\"\"
Financial Services

The Real Cost of a Manual POA Process at Your Credit Union

Power of attorney documents show up at some of the most consequential moments in a member's life. And yet, for most credit unions, the POA process is still built around paper. If that friction is costing you member trust, it is also costing you something else: time, money, and competitive ground.
\"\"
Jessica Howe
July 20, 2026
\"\"
Legal

A Historic Step Toward the American Dream

On July 10th, the 21st Century ROAD to Housing Act became law, marking the most significant bipartisan housing reform in decades. ROAD stands for Renewing Opportunity in the American Dream, and that is what the law sets out to do: expand access to homeownership for more Americans.
\"\"
James Fulgenzi
July 17, 2026
\"\"
Hiring & Onboarding

This Is What Candidate Fraud Looks Like From the Inside

Do you know how candidate fraud scams actually get built? Last week, a member of Proof's team received an email that answers that question directly.
\"\"
Lauren Ding
July 15, 2026
\"\"
Fraud

The Fraud Files: Agents, Impersonation, and the Identity Layer Nobody Built | July 2026

AI agents are transacting on behalf of real people, on real payment rails, right now. The fraud ecosystem built around that fact is already operational, and this month's headlines show exactly how the attack surface is forming.
\"\"
Ray Hayes
July 13, 2026
\"\"
Digital Identity

What Is Digital Identity? A Complete Guide

Digital identity is a persistent, cryptographically secured credential that represents a verified person. Once established, it does not expire with a session or reset between transactions. It travels with the user across interactions, and it gets stronger and more useful with every use.
\"\"
Anna Scionti
July 10, 2026
\"\"
Hiring & Onboarding

The Return to In-Person Interviews Is an Admission, Not a Strategy

What companies bringing interviews back in person have concluded is that they cannot verify who is sitting on the other end of a video call with enough confidence to make the hire. However, the remote-first format alone wasn’t the issue. What was missing underneath it was an identity layer reliable enough to make remote interviews trustworthy.
\"\"
Lauren Furey
July 8, 2026
\"\"
Auto

Why Auto Lenders Can't Afford to Keep Mailing POAs

Every auto refinance starts the same way: the borrower agrees to the new terms, the deal is approved, and then someone has to get a power of attorney signed so the lender can handle the title transfer without the borrower standing at the DMV counter in person. The lenders who are fixing this are funding faster, cutting operational costs, and closing a fraud vulnerability that paper processes leave wide open.
\"\"
Emmy Leitzell
July 6, 2026
\"\"
Hiring & Onboarding

When You Find One Fraudulent Hire, You Usually Find More

If one bad actor is successfully hired, they can act as a reference for others, using their insider knowledge of the employer's hiring process to coach additional fraudulent candidates through. That changes the threat model significantly. A single fraudulent hire inside a large remote workforce represents a vulnerability that has already been exploited to map the organization's defenses, and that map is being shared.
\"\"
Trisha Sood
July 1, 2026
\"\"
Product & News

The Identity Infrastructure for the Internet

The internet needs an identity layer that cryptographically proves who you are, what you've done, and which agents are operating in your name. To solve these challenges, we're releasing x401, an open, issuer-neutral protocol for the identity and authorization challenges created by agents, along with Proof digital ID, the first live implementation on x401, to bring a verified human identity and authorization to every agent action.
\"\"
Pat Kinsel
June 29, 2026
\"\"
Digital Identity

The Five Levels of Verified Identity For the Agent Economy

AI agents are moving money, but who verifies them? Explore the 5 levels of identity infrastructure required to make the agent economy safe and scalable.
\"\"
Darren Louie
June 26, 2026
\"\"
Product & News

Introducing x401: Bringing Proof of Identity to the Web

HTTP got a payment status code in 1997. It never got an identity one. We're fixing that. And, with AI agents acting on our behalf now, it matters more than ever.
\"\"
Daniel Buchner
June 25, 2026
\"\"
Product & News

Proof Launches x401, the Open Protocol for Verifying the Authority Behind AI Agents

Developed by Proof with contributors across payments, identity and AI, x401 lets any online service request proof of who authorized an agent’s actions. Live demos and a CLI are available today.
\"\"
Proof
June 25, 2026
\"\"
Digital Identity

Why You Can’t Get Pokémon Center Drops (Hint: It’s Not Just Site Issues)

On June 10, 2026, Pokémon Center opened preorders for the Mega Evolution: Pitch Black expansion and, within minutes, the site was down. For retailers and publishers managing high-demand, limited-inventory drops, identity verification at the point of queue entry is the mechanism that makes the difference between a queue full of real customers and a queue full of software.
\"\"
Mark Loiselle
June 24, 2026
\"\"
Fraud

The Fraud Files: Stolen Credentials, Fake Biometrics, and the Synthetic Identity Wave | June 2026

The way financial institutions verify identity was built around three assumptions: that some information stays secret, that documents can be trusted, and that a face in a camera is a real face. June's research shows each of those assumptions under sustained, commercial-scale attack, with numbers to prove it.
\"\"
Ray Hayes
June 23, 2026
\"\"
Workflow

Sherpas Healthcare Solutions Wins More Clients with Remote Online Notarization

Sherpas Healthcare Solutions takes the complexity out of chart audit requests for healthcare providers. As demand for notarized affidavits on those records grew, the company ran into a hard limit: they had no way to offer notarization services, and they were losing business to vendors who could. Remote online notarization with Proof gave them a way to say yes.
\"\"
Taylor Curtiss
June 18, 2026
\"\"
Product & News

Cleaner Data, Tighter Security, and More Admin Control This June

This month's updates are built for Enterprise and Command Center teams that need tighter control over their data and security posture. From deactivating child organizations directly in Command Center to pulling audit events into your SIEM and exporting richer transaction data, June's release gives admins more visibility and more power without requiring a support ticket or a CSM.
\"\"
Proof
June 18, 2026
\"\"
Technology

Electronic Signatures vs. Digital Signatures: What's the Difference?

The terms get used interchangeably, but they describe fundamentally different things. For most casual use cases, the distinction doesn't matter much. For regulated industries, high-value contracts, or anything that might end up in litigation, it matters a lot.
\"\"
Anna Scionti
June 17, 2026
\"\"
Hiring & Onboarding

How Generative AI Turned Candidate Fraud Into an Industry

Generative AI has transformed hiring fraud from an individual crime into an industrialized operation, changing the economics so completely that the defenses built for the previous era no longer apply.
\"\"
Taylor Curtiss
June 16, 2026
\"\"
Workflow

Why Equipment Finance Teams Can't Afford a Manual POA Process

The equipment finance industry is on a growth trajectory. The companies that take POAs digital now are the ones that close deals faster, carry less documentation risk, and build the kind of customer experience that brings lessees back for their next transaction.
\"\"
Taylor Curtiss
June 15, 2026
\"\"
Digital Identity

How to Implement Digital Identity Verification

Digital identity verification has become a baseline requirement for any organization that onboards customers, processes transactions, or manages sensitive documents online. This guide breaks down the core components of a digital identity verification system, the methods available, and what a thoughtful implementation looks like in practice.
\"\"
Courtney Leary
June 12, 2026
\"\"
Workflow

Is Remote Online Notarization Legal and Available in All States?

Remote online notarization (RON) is legal in 49 states and the District of Columbia as of 2026. California is the only outlier, with its permanent RON statute set to take effect on January 1, 2030. If your business is thinking about digitizing notarization workflows: yes, RON is an option.
\"\"
Phil Motto
June 11, 2026
\"\"
Hiring & Onboarding

Why Only 31% of CHROs Are Confident They Can Stop Hiring Fraud

While Chief Human Resources Officers (CHROs) agree hiring fraud requires attention, many doubt their organizations are equipped to stop it. This gap highlights a critical issue: awareness has risen, but infrastructure has not. Fraud persists despite organizational recognition.
\"\"
Renée Hunter
June 10, 2026
\"\"
Fraud

Real Estate Fraud Hit $275M in 2025. The Fix Isn't Better Agent Training.

Real estate fraud hit $275M in 2025, up 58%. AI is making fake IDs fast enough to pass standard verification at closing.
\"\"
Proof
June 8, 2026
\"\"
Workflow

Proof Puts Itself To The Test For Account Recovery

IT teams live at the intersection of access and urgency. When an employee is locked out, the pressure is to get them back in fast, and the path of least resistance has always been a direct message. For Proof's IT team, the answer was...Proof.
\"\"
Felicia Carnell
June 5, 2026
\"\"
Hiring & Onboarding

Your Interviewers Can't Catch Deepfakes. That's Not Their Fault.

If you ask most hiring managers whether they could spot a fake candidate in an interview, a significant number will say yes. They will point to their experience, their instincts, their ability to read a candidate's comfort with their own claimed background. That confidence is understandable and, according to the data, largely misplaced.
\"\"
Ashley Bird
June 4, 2026
\"\"
Real Estate

The Top States for eClosings in 2026

Your market has already made its decision. Peers and competitors are closing digitally, at significant volume, and they are getting faster at it. And the pattern is consistent: once enabling infrastructure is in place and a few early movers commit, adoption accelerates quickly.
\"\"
Kavya Qin
June 3, 2026
\"\"
Workflow

What is Remote Online Notarization?

The traditional notarization process has a well-known rhythm: print the document, find a notary office, drive there, show your ID, wait for the stamp. The whole thing can take the better part of a morning, and if anything goes wrong (wrong document, wrong ID, wrong office), you start over.Remote online notarization was built to replace that. Same legal result, without the overhead.
\"\"
Jessica Howe
June 3, 2026
\"\"
Hiring & Onboarding

How to Catch Candidate Fraud Without Changing Your Lever Workflow

We often see hiring teams skip identity verification because the tools available for it sit outside of their ATS. Requiring identity verification for candidates forces teams to manage a separate system and add steps for which they don’t have bandwidth or expertise. Proof now closes that gap for teams that use Lever.
\"\"
Eric Nelson
May 28, 2026
\"\"
Product & News

Proof and Enigma Partner to Launch a Verified Business Identity and Authorization Layer for U.S. Businesses

Every business needs to claim its identity online. We built the infrastructure to do it.\n
\"\"
Pat Kinsel
May 27, 2026
\"\"
Fraud

Salesforce Under Attack: What the ShinyHunters Breach Reveals About CRM Identity Risk

ShinyHunters stole 600,000 Salesforce records from a 7-Eleven franchisee. Here's what the breach reveals about CRM identity risk.
\"\"
Proof
May 27, 2026
\"\"
Product & News

A Better Way to Notarize, for Cohen & Fitch LLP and Every Client They Serve

Cohen & Fitch LLP is a New York civil rights firm. Their clients are navigating some of the hardest moments of their lives, and the last thing they need is friction around paperwork. So the firm built a notarization process that gives every client a real choice: come in person, handle it themselves through a local notary, or complete everything remotely through Proof on their own time.
\"\"
Proof
May 26, 2026
\"\"
Product & News

Verified Identities, New Closing Types, and Faster Document Prep. Here's What's New in May.

May's updates are focused on giving you more confidence and control at every stage of the transaction process. From a new verified badge that surfaces IAL2 verification status directly on identity profiles, to new transaction types for Title agents, to bulk sidebar actions that cut down document prep time significantly, this release is built to make your team faster and your transactions more trustworthy.
\"\"
Proof
May 26, 2026
\"\"
Fraud

The Fraud Files: Bank Insiders, BEC Billions, and the AI Threat to ACH Payments | May 2026

This month's fraud headlines read less like news and more like a preview of what happens when corporate ACH originators reach June 22 still exposed. Five signals, one through-line: authorized payments that should not have moved.
\"\"
Ray Hayes
May 22, 2026
\"\"
Hiring & Onboarding

The Interview Isn't Where Candidate Fraud Gets Caught

There is a documented case of a job applicant using deepfake technology to conduct a convincing interview for 70 minutes before being caught. That case gets cited as evidence of how good the fakes have gotten. But the more interesting (and maybe more important) thing it reveals is what had already happened before the call started.
\"\"
Lauren Furey
May 20, 2026
\"\"
Hiring & Onboarding

The Insider Threat Your Hiring Pipeline Was Never Built to Catch

Insider threat programs have long been a fixture at companies with high value assets. The threat model that justified that investment assumed a relatively targeted attacker: a nation-state, a competitor, or a sophisticated actor with a specific reason to come after that specific organization. That threat model is changing.
\"\"
John Heasman
May 18, 2026
\"\"
Fraud

The New Generation of Scattered Spider Is Turning Account Recovery Into a Seven-Figure Business

In 2023, a threat group called Scattered Spider dismantled two of the largest casino operations in the world. The next generation is now running seven figure scams, and they are actively targeting organizations across financial services, retail, hospitality, legal, aviation, technology, and academia.
\"\"
Winnie Jin
May 12, 2026
\"\"
Fraud

Real Names, Fake IDs, and a Bank Insider: The Massachusetts Fraud Ring That Beat Two Lines of Defense

A guilty plea in federal court last week pulls back the curtain on a coordinated bank fraud ring that operated across three states for more than two years. The scheme had two distinct vulnerabilities that let it run undetected. Both of them are solvable.
\"\"
Jessica Howe
May 8, 2026
\"\"
Technology

Agentic AI Needs Verifiable Records to Be Trusted

Logs and explanations are not enough. If agentic AI is going to operate in real world workflows, it needs verifiable records.
\"\"
Lauren Hintz
May 6, 2026
\"\"
Product & News

Proof Joins FIDO Alliance to Link AI Agent Actions to Verified Human Identity

As the only platform that can verify identity to NIST IAL2 and cryptographically bind it to agent activity, Proof brings a critical perspective to the standards defining how AI acts on behalf of humans.
\"\"
Proof
May 4, 2026
\"\"
Fraud

The Fraud Files: Fraud Rings, AI Scams, and the Signals to Watch | April 2026

Fraud trends rarely change all at once. More often, the signals appear gradually across research reports, news stories, and the operational reality of how organizations process digital transactions. Here are five signals from the past month that fraud and risk teams should be paying attention to.
\"\"
Ray Hayes
April 29, 2026
\"\"
Fraud

Wigs, Fake IDs, and $19.8 Million in Loans: What the NFL Impersonation Scam Means for Lenders

A former college football player disguised himself as three NFL stars to secure nearly $20 million in loans. The lenders who approved them had no reliable way to know the difference.
\"\"
Jim Schaffer
April 27, 2026
\"\"
Product & News

Built for How You Work | What's New at Proof in April

April's features are focused on speed and efficiency. From pre-built transaction templates to copy/paste shortcuts, self-serve plan upgrades, and smarter risk signals in Defend, here's what's new.
\"\"
Proof
April 21, 2026
\"\"
Fraud

The VINsanity Indictment and the Urgent Need for Banks to Adopt Real Identity Verification

Auto loan fraud is a serious crime that drives up costs for every honest consumer. It threatens the stability of lending institutions and undermines the digital economy. The VINsanity case illustrates the urgent need for better security across the industry.
\"\"
Jessica Howe
April 20, 2026
\"\"
Digital Identity

Why KYC Alone No Longer Stops Fraud (and What Comes Next)

KYC verifies whether customer information matches trusted data sources at onboarding. It confirms that a name, date of birth, or identification number aligns with existing records to meet compliance requirements. Modern fraud does not try to break that model. It works within it.
\"\"
Anna Scionti
April 13, 2026
\"\"
Fraud

The $17 Million Real Estate Fraud Case That Should Change How Title Agents Verify Identity

The U.S. Department of Justice charged 11 people in a sophisticated conspiracy targeting elderly homeowners. By stealing identities, these criminals secured millions in hard money loans against properties they had absolutely zero claim to.
\"\"
Kavya Qin
April 8, 2026
\"\"
Digital Identity

What the U.S. Can Learn from Sweden’s BankID

Identity fraud is rising in the U.S. due to fragmented verification. Learn why Sweden’s BankID model works and how Proof provides the cryptographic identity layer needed for high-risk digital commerce.
\"\"
Lauren Hintz
April 6, 2026
\"\"
Fraud

AI Is Industrializing "Pig Butchering." Can Dating Apps Still Prove Their Users Are Real?

The San Francisco Standard recently detailed a chilling evolution in the world of digital connection. "Pig butchering" scams, once the domain of low-level scripts, are now being powered by sophisticated generative AI. While the public focus is often on the devastating financial losses of the victims, there is a quieter, equally dangerous crisis unfolding for the dating platforms where these scams begin.
\"\"
Jessica Howe
April 1, 2026
\"\"
Digital Identity

23 NYCRR Part 500 Is a Regulatory Shift from Authentication to Attribution

NYDFS 23 NYCRR Part 500 signals a shift from authentication to identity attribution. Learn why financial institutions must now provide verifiable, digital evidence.
\"\"
John Heasman
March 30, 2026
\"\"
Technology

Passwordless Security: Why the Future of Authentication Still Starts with Identity

For security teams and product teams alike, the appeal is straightforward. Passwordless systems reduce the risk of credential theft while also making login faster and easier for legitimate users. But removing passwords does not eliminate identity risk. It simply changes where that risk appears.
\"\"
Lauren Furey
March 25, 2026
\"\"
Product & News

Deepfake Detection, Persistent Identity, and More — What's New in March

This month's updates bring stronger fraud protection, faster identity verification, and more control for enterprise teams. From real-time deepfake detection in notary meetings to one-click identity reuse and new org management tools, there's something here whether you're running closings, preparing documents, or managing a multi-branch operation.
\"\"
Proof
March 23, 2026
\"\"
Product & News

Get Paid the Moment You Complete: Instant Payouts Are Now Available on Proof

Notaries on the Proof platform can now receive earnings directly to their Visa debit card — often within minutes of completing a session.
\"\"
Lauren Furey
March 19, 2026
\"\"
Real Estate

Proof surpasses $640 billion in real estate transactions

Rapid growth in residential real estate transactions on the platform indicates the industry is accelerating digital transformation to prioritize fraud prevention.
\"\"
Proof
March 17, 2026
\"\"
Legal

The President’s Executive Order Is a Win for Digital Closings

On March 13, President Trump signed an Executive Order to expand access to mortgage credit and address the regulatory barriers that have made buying a home harder and more expensive than it needs to be. We commend the administration for this leadership.
\"\"
James Fulgenzi
March 16, 2026
\"\"
Fraud

Account Recovery: The Security Risk Hiding in Help Desk Requests

Multi-factor authentication, fully-integrated identity providers, and passwordless logins have made it harder for attackers to break into enterprise systems using brute force. But attackers rarely attack the strongest defensive points directly. Instead, they look for the easiest path to gain access...account recovery workflows.
\"\"
Jeff Spencer
March 16, 2026
\"\"
Fraud

Hospice Scams: What They Are, How They Work, and What Legitimate Providers Must Do Now

Hospice fraud is not new. But in Los Angeles, the scale has reached a level that federal investigators describe as unprecedented.
\"\"
Courtney Leary
March 11, 2026
\"\"
Product & News

Proof and IDEMIA Public Security Partner to Deliver Privacy-Preserving Digital Identity Solutions for Trusted Interactions Across Physical and Digital Ecosystems

Proof, the trusted platform for securing the digital economy with cryptographically secured identity, and IDEMIA Public Security, a global leading provider of secure digital identity and trusted biometric-based solutions, today announced a strategic partnership to enable a trusted, broadly usable, privacy-preserving identity experience through a verifiable digital credential (VDC) that spans physical, logical ,and digital domains.
\"\"
Proof
March 3, 2026
\"\"
Technology

Identity Verification for SaaS: Why Authentication Alone Is No Longer Enough

For years, SaaS security has focused on authentication. But in 2026, that gap between authentication and real identity is becoming one of the biggest operational risks platforms face.
\"\"
Jessica Howe
March 2, 2026
\"\"
Digital Identity

Why Michigan’s Move Signals the Next Era of Identity Verification

Michigan recently updated its remote notarization standards to allow biometric authentication for identity verification, with clear guardrails in place. Their move from KBA to biometrics is not just about adopting new technology. It addresses foundational security gaps.
\"\"
Lauren Furey
February 26, 2026
\"\"
Financial Services

The $84 Trillion Wealth Transfer Is Exposing a Client Experience Gap

Roughly $84 trillion in assets is projected to transfer between generations over the next two decades. For wealth management firms, this creates both opportunity and exposure.
\"\"
Kris Singh
February 25, 2026
\"\"
Financial Services

Wealth Management Identity Verification: What Firms Need to Get Right in 2026

What wealth management firms need from identity in 2026: consistent verification, defensible authorization, and audit-ready records without adding client friction.
\"\"
Ray Hayes
February 23, 2026
\"\"
Real Estate

From Escrow to Closing: Securing Every Step of the Home Purchase Lifecycle

From escrow to closing, identity risk touches every moment that matters. Learn how title teams use layered verification to secure the full transaction lifecycle.
\"\"
Kavya Qin
February 19, 2026
\"\"
Digital Identity

Identity Verification for Subscription Platforms: Why Payments Tools Aren't Enough

Across subscription businesses, identity weaknesses are showing up as fraud losses, rising chargebacks, creator impersonation, regulatory pressure, and mounting operational strain. For platforms that touch adult entertainment in particular, those pressures are arriving faster and with higher stakes.
\"\"
Kris Singh
February 12, 2026
\"\"
Fraud

Top 10 Platforms Helping Credit Unions Fight Fraud in 2026

From account takeovers and synthetic identities to impersonation in contact centers and document tampering in lending workflows, credit unions are dealing with threats that traditional controls were not designed to stop. The strongest platforms today combine identity verification with fraud intelligence so credit unions can make confident decisions without adding friction for real members.
\"\"
Drew Sadik
February 4, 2026
\"\"
Digital Identity

What 2026 Market Conditions Say About The Future of Trust & Identity

Identity is now being treated as core infrastructure, and the market is responding accordingly. You can see it across three distinct areas, accelerating at the same time: government contracts, private investment, and state/federal policies.
\"\"
Jeff Spencer
February 2, 2026
\"\"
Digital Identity

If Your Game Has an Economy, It Has an Identity Problem

Gaming and gambling platforms are no longer just managing gameplay. They are managing economies, identities, and real financial risk. Fraud will continue to evolve. Bots will get smarter. Credentials will keep circulating. The platforms that stay ahead will be the ones that stop guessing and start verifying.
\"\"
Jessica Howe
January 28, 2026
\"\"
Hiring & Onboarding

How to Add Identity Verification to Your ATS Without Slowing Hiring

Integrating Proof with your ATS helps ensure that the person applying, interviewing, and onboarding is the same real human, without forcing teams or candidates into awkward workflows. It closes the identity gap that modern hiring fraud exploits.
\"\"
Lauren Furey
January 21, 2026
\"\"
Hiring & Onboarding

What HR Teams Are Seeing When It Comes to Candidate Fraud

Candidate fraud is already present in hiring processes. Most teams are not verifying candidate identities before making an offer. For HR leaders, the takeaway is not to overhaul hiring overnight or introduce unnecessary friction. It is to recognize that trust in hiring now requires identity verification at specific points throughout the process.
\"\"
Jeff Spencer
January 19, 2026
\"\"
Digital Identity

Identity On-Chain: What It Could Mean for Compliance, Trust, and the Future of Crypto

Identity on-chain, when approached as verifiable compliance rather than de anonymization, can help bridge the gap between regulators and innovators. Digital credentials, whitelisted wallet logic, and zero knowledge proofs are not silver bullets, but they are promising components of a more scalable and principled trust architecture.
\"\"
James Fulgenzi & Ray Hayes
January 14, 2026
\"\"
Digital Identity

When Ticketing Goes Digital, Identity Becomes the Risk Surface

Proof helps organizations establish trust at the moments in ticketing where proof of identity matters most.
\"\"
Drew Sadik
January 12, 2026
\"\"
Digital Identity

Top 10 Identity Verification Solutions to Consider in 2026

This guide breaks down what we think will be the top 10 IDV solutions that organizations will rely on in 2026. Each one approaches identity differently, from high-assurance proofing to global coverage, biometrics, risk analytics, or compliance-driven onboarding.
\"\"
Courtney Leary
January 8, 2026
\"\"
Technology

Medallion Signature Guarantees vs Remote Online Notarization: Different Tools, Different Risks

For organizations reviewing their workflows, the right question is not which stamp to choose. It is where each level of assurance is actually required, and where modern digital tools can reduce friction without weakening trust.
\"\"
Lauren Hintz
January 5, 2026
\"\"
Digital Identity

What 2025 Reminded Us About Trust

As we reach the end of 2025, one thing stands out. Trust can no longer be treated as a one-time decision. It has to persist across interactions, adapt to context, and hold up when decisions are questioned later.
\"\"
Darren Louie
December 29, 2025
\"\"
Fraud

Was This You? | The Everyday Moments Where Fraud Slips In

Today’s fraud doesn’t look like a crime scene. It looks like a normal workflow with one strange detail. These small, odd moments are where the biggest losses start - and they’re getting harder to catch with traditional tools.
\"\"
Jessica Howe
December 22, 2025
\"\"
Digital Identity

What is A Medallion Signature Guarantee?

Medallion signature guarantees were built for a world of paper certificates and in person processes. Modern identity assurance and digital notarization can complement these legacy tools. They can help organizations protect more of their workflows, support customers who expect digital experiences, and build better evidence about who signed what and when.
\"\"
Lauren Hintz
December 16, 2025
\"\"
Fraud

How Proof’s Layered Intelligence Model Outperforms Passive Fraud Detection 600 - 1,300% With Minimal Friction

Passive-only fraud modeling isn’t good enough to address modern threats. Learn how Proof's blend of passive, active, and identity network signals reduces fraud and outperforms industry benchmarks by as much as 13X.
\"\"
Sam Fields
December 12, 2025
\"\"
Hiring & Onboarding

Top 10 Candidate Fraud and Identity Verification Tools to Consider in 2026

This guide breaks down the top 10 candidate identity fraud and impersonation prevention tools that will lead the way in 2026.
\"\"
Lauren Furey
December 10, 2025
\"\"
Digital Identity

The Future of Digital Identity: Why mDocs, Verifiable Credentials, and DIDs Matter

Digital identity is entering a new phase. The decade ahead is about something deeper: trustworthy, portable, cryptographically verifiable identities that work across every workflow, every system, and every institution. mDocs, Verifiable Credentials, and Decentralized Identifiers are the core standards shaping that future.
\"\"
Lauren Hintz
December 9, 2025
\"\"
Digital Identity

Understanding Persistent Identity: How Trust Becomes Something You Can Reuse

Persistent identity gives organizations a reliable, reusable identity layer that works across workflows. It gives users a smoother experience without lowering security, and teams a clearer, more consistent identity signal to base decisions on.
\"\"
Anna Scionti
December 8, 2025
\"\"
Digital Identity

Introducing Persistent Identity: The Foundation of Repeatable Trust

Persistent identities allow individuals to verify their identities once, to a high-assurance standard (IAL2), and then save that identity on the Proof platform so they can quickly re-authenticate in future interactions using a simple biometric match. Now trust doesn’t have to be rebuilt from scratch. It can persist.
\"\"
Anna Scionti
December 2, 2025
\"\"
Financial Services

The Hidden Cost of Account Opening Rework (And Why It’s Time to Fix It)

Rework slows onboarding, drains advisor time, and chips away at client trust. Here’s what it really costs retirement firms and how modern identity fixes it.
\"\"
Ray Hayes
November 26, 2025
\"\"
Digital Identity

The Future of Digital Trust: Identity-Backed Interactions

As deepfakes, AI impersonation, and stolen credentials grow more common, familiar signals of trust like signatures, logins, or visual ID checks are no longer enough. Trust now depends on knowing that every interaction can be tied to a verified legal identity.
\"\"
Lauren Hintz
November 25, 2025
\"\"
Fraud

The Price of Trust: Why Fraud and Trust in Digital Business Are Inseparable

In business, trust has always been currency. In the digital economy, it has also become collateral. Every transaction, customer interaction, and data exchange now depends on a single premise: that the other party is who they claim to be. When that assumption fails, the damage does not stop at a breach. It ripples through every part of the business.
\"\"
Gary Weingarden
November 24, 2025
\"\"
Financial Services

From Days to Minutes: How Remote Online Notarization Is Transforming the Equipment Financing Industry

Manual notarization slows deals down. Teams chase signatures, wait for scheduling, and lose time to errors that surface right before delivery. With Proof, digitizing the entire customer journey from identity verification to notarizing documents results in a workflow built for today’s pace: fast for customers, transparent for teams, and secure from start to finish.
\"\"
Justin Rossi
November 19, 2025
\"\"
Product & News

Visa Ventures Invests in Proof

Today, we announce that Visa Ventures has made a strategic investment in Proof, deepening our shared commitment to securing the digital economy.
\"\"
Pat Kinsel
November 18, 2025
\"\"
Financial Services

The Top 9 Digital Transformation Solutions for Credit Unions in 2026

Digital transformation in credit unions has entered a new phase. Going digital isn’t enough anymore. The mission for 2026 is digital certainty: combining the speed and intelligence of fintech with the trust and protection your members expect.
\"\"
Winnie Jin
November 17, 2025
\"\"
Hiring & Onboarding

Hiring in the Digital Era: Why Identity Proofing Matters More Than Ever

In hiring, the question is no longer whether identity verification matters. It is how to do it well, without creating friction for legitimate applicants or deterring great talent.
\"\"
Ashley Bird
November 12, 2025
\"\"
Product & News

Looking Ahead: What’s Coming for Notaries Using Proof

Every year on November 7, we celebrate National Notary Public Day. It is a moment to recognize the essential work notaries do to uphold trust in everyday life. So our belated National Notary Public Day gift to you is an early look at what is coming next!\n
\"\"
Nicole Clark
November 10, 2025
\"\"
Product & News

National Notary Public Day: A Thank You, and a Simple Way to Earn More

November 7 is National Notary Public Day. To celebrate, we're sharing practical ways to grow reliable income right now. Not by working longer hours or compromising time with family, but by leveraging the professional relationships you've already built and nurtured.
\"\"
Nicole Clark
November 7, 2025
\"\"
Product & News

Gary Weingarden Joins Proof as Chief Privacy Officer

Proof, the leading identity authorization network, today announced that Gary Weingarden has been appointed as the company’s Chief Privacy Officer (CPO). Weingarden will lead Proof’s Global Privacy, Governance, Risk & Compliance (GRC), and Identity Standards & Governance programs, ensuring the company’s growing platform maintains its high standards for privacy, resilience, and compliance.
\"\"
Proof
November 6, 2025
\"\"
Real Estate

How to Migrate to a New Online Notarization Provider Without Disrupting Closings

Your first RON platform may have failed you — but RON didn’t. See how to transition to a better online notarization solution without slowing down closings.
\"\"
Justin Rossi
November 5, 2025
\"\"
Product & News

Money20/20 Recap: The New Standard for Trust

Money20/20 is always a pulse check on where financial technology is headed. Across payments, lending, banking, insurance, wealth, and digital assets, leaders told us the same thing: fraud is evolving faster than legacy defenses can keep up. The customer experience has become a differentiator, not a feature.
\"\"
Rebecca Olsho
November 3, 2025
\"\"
Hiring & Onboarding

Trust Doesn’t End on Day One: Continuous Identity for Ongoing Access

Onboarding is only the beginning of trust. After identity is initially verified and accounts are created, identity risk does not disappear; it changes shape.
\"\"
Darren Louie
October 30, 2025
\"\"
Digital Identity

The Evolving Landscape of Authentication

Authentication is the foundation of digital security. For years, that meant little more than a password. But as threats evolve and customer expectations rise, organizations are adopting smarter, more layered ways to verify identity. In this blog, we’ll break down five leading authentication methods: what they are, how they work, and how Proof helps organizations strengthen trust across every interaction.
\"\"
Lauren Furey
October 29, 2025
\"\"
Hiring & Onboarding

Inside the Interview: Building a Trust Framework for Remote Onboarding

By the time someone reaches the interview stage, your organization has already learned a lot about them on paper. The question that still matters most is the one technology alone can’t answer: is this person real? In today’s remote-first environment, that’s where risk shifts. The early filters may confirm skills and experience, but mid-funnel is where impostors try to slip through. It’s the moment when a legitimate process meets an unverified human — and where Proof keeps trust intact.
\"\"
Darren Louie
October 28, 2025
\"\"
Product & News

Next-Level Fraud Protection, Real-Time Control, and a Smoother Signing Flow

Protect your business from fraud, reduce operational overhead, and give users more flexibility—without sacrificing trust.
\"\"
Proof
October 27, 2025
\"\"
Legal

BSA for the Digital Age: Our Answer? A Policy Framework for Digital Credentials

Financial institutions spend billions annually verifying the same identities over and over. In our response to the U.S. Treasury's Request for Comment on Innovative Methods to Detect Illicit Finance in Digital Assets, we propose a solution: verify once, trust everywhere. Our framework doesn't just address digital assets—it reimagines Bank Secrecy Act (BSA) compliance for the entire financial system.
\"\"
James Fulgenzi
October 24, 2025
\"\"
Product & News

Proof Collaborates With Visa to Secure Digital Transactions

As EMV® Contact Chip cards secure in-person transactions, trusted identities will protect digital transactions.
\"\"
Proof
October 23, 2025
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n","snapshot_chars":374517,"live_check":"changed"},{"url":"https://articles.idenhq.com/ai-agent-identity-management-2026","committed_hash":"sha256:58ac4b83adda607543a30574244044143450b9aa2aafcbf61cc71de9e8b4fccf","committed_hash_short":"sha256:58ac4b83…e8b4fccf","mime_type":"text/html","committed_at":"2026-07-27T09:00:19.923553+00:00","content_snapshot":"AI Agent Identity Management 2026: Standards & Gaps | Iden Blog
Book demo
Field NotesPlaybooks
LoginBook demo
BlogAuf Deutsch lesen

AI Agent Identity Management in 2026: Standards, Players, and the Governance Gap

MCP OAuth 2.1, MCP-I at the DIF, Microsoft Entra Agent ID - the 2026 standards landscape for AI agent identity is taking shape. Here's what's real, what's missing, and how to evaluate governance today.

10 min read · Last updated July 2026

The numbers are no longer theoretical. More than 80% of Fortune 500 companies now run active AI agents built with low-code and no-code tools[1], and Gartner projects that up to 40% of enterprise applications will include integrated task-specific AI agents by the end of 2026, up from less than 5% today[2]. Yet the security posture underneath that deployment wave is alarming: on average, only 47.1% of an organization's AI agents are actively monitored or secured[3]. The other half operate without oversight, logging, or identity controls.

\n

This is not a future problem. It is the current state of your production environment.

\n

The good news - if you can call it that - is that the standards community has noticed. In the first half of 2026, more governance specifications landed for AI agent identity than in the entire prior history of the field. This post maps what those standards actually say, which vendor categories are responding, where the real gaps remain, and what a buyer should demand today.

\n
\n

The Standards Landscape: What's Actually Shipping

\n

MCP OAuth 2.1 Under Linux Foundation Governance

\n

The Model Context Protocol started as an Anthropic experiment in November 2024. By December 2025, Anthropic had donated MCP to the Agentic AI Foundation (AAIF) under the Linux Foundation, with OpenAI, Block, AWS, Google, Microsoft, Cloudflare, and Bloomberg joining as founding or platinum members[4]. Within four months, the AAIF grew to 170 member organizations - more than double the membership CNCF had at the same stage of its life[5].

\n

The governance shift matters for enterprise buyers. MCP is no longer a single-vendor protocol that any one company can deprecate or fork. It is now closer in structure to CNCF than to a proprietary API.

\n

On authentication specifically: the MCP spec mandates OAuth 2.1 with PKCE for all protected HTTP-based deployments, requiring HTTPS on all endpoints and discoverable authorization server metadata[6]. The 2026 roadmap, published in March, makes enterprise readiness - including audit trails, SSO-integrated auth, and configuration portability - a top priority. The spec's authorization Working Group had six dedicated sessions at the April 2026 MCP Dev Summit, with the OAuth 2.1 spec author present.

\n

The 2026 MCP roadmap flagged audit trail infrastructure, SSO-integrated auth, and configuration portability as the top enterprise requests[7]. None of those are solved yet. The roadmap is a commitment, not a delivery.

\n
warning Warning

The authentication gap is real. Research published in early 2026 documented more than 1,800 active MCP servers on the public internet with no authentication whatsoever. Because authentication in MCP is optional — not required by the spec — they are technically compliant and practically insecure. Before deploying any MCP server, verify OAuth 2.1 is enabled and enforced, not just installed.

\n\n\n\n

MCP-I / KYA-OS: Decentralized Identity for Agents

\n

OAuth 2.1 handles authentication - proving an agent is who it claims to be. It does not answer the harder questions: Who authorized this agent? What is it allowed to do on behalf of which human? Can a downstream service verify that chain without prior coordination?

\n

In March 2026, Vouched formally donated the Model Context Protocol - Identity (MCP-I) framework to the Decentralized Identity Foundation (DIF), where it is now stewarded by the DIF Trusted AI Agents Working Group[8]. The spec has since been renamed KYA-OS (Know Your Agent Operating System) to reflect its scope beyond MCP alone.

\n

MCP-I / KYA-OS uses Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) to enable cryptographically secure verification of both agents and their human principals - without requiring prior coordination between parties[9]. The framework defines four identity questions every service should be able to answer: Who is the agent? Who authorized it? What is it allowed to do? What is the scope of that delegation?

\n

This is the right architecture for multi-organization agent workflows - a travel booking agent acting on behalf of a user across airline, hotel, and payment systems, for example. It is also early. The spec is in active community development, and production implementations are sparse.

\n

Microsoft Entra Agent ID

\n

Microsoft moved fastest among the major identity platforms. Microsoft Entra Agent ID introduces agent identities as a distinct, purpose-built construct - not a repurposed service principal or user account - with agent identity blueprints serving as templates for creating individual agent identities with parent-child relationships[10].

\n

Agent identities in Entra do not have credentials of their own; they rely on the agent identity blueprint to acquire tokens on their behalf, and they only authenticate using federated identity credentials[11]. This is the right model: credentials live in the blueprint, not on the agent, so a compromised agent cannot exfiltrate its own keys.

\n

Microsoft Agent 365, generally available from May 1, 2026, gives each AI agent its own Entra Agent ID for identity, lifecycle, and access management, and integrates with Conditional Access, identity protection, and Microsoft Purview[12]. Third-party agents from AWS Bedrock, n8n, and other frameworks can be onboarded via workload identity federation - no platform-specific credential management required.

\n

The honest limitation: Entra Agent ID is a strong solution if your agent estate lives inside the Microsoft ecosystem. For organizations running heterogeneous stacks - Anthropic, AWS, open-source frameworks, and custom-built agents - the governance surface extends well beyond what any single IdP can cover.

\n

CSA Agentic Trust Framework and CSAI Foundation

\n

The Cloud Security Alliance has been the most prolific standards producer in this space. The CSA published the Agentic Trust Framework (ATF) on February 2, 2026 - the first governance specification applying Zero Trust principles to autonomous AI agents with a structured maturity model[13]. The ATF was co-authored by John Kindervag, the original creator of Zero Trust.

\n

A companion survey of 285 IT and security professionals makes the urgency concrete: 84% of organizations cannot pass a compliance audit focused on agent behavior or access controls, and only 23% have a formal agent identity strategy[14].

\n

The CSA's MAESTRO threat modeling framework explicitly names agent impersonation as a distinct threat class - malicious actors deceiving users or other agents by impersonating legitimate AI agents. The prescribed mitigations are trusted agent registries, cryptographic agent identities, and short-lived OAuth/OIDC tokens scoped to the intersection of what the agent is allowed to do AND what the delegating user is allowed to do. An AND gate, not an OR gate.

\n

In March 2026, the CSA launched the CSAI Foundation at RSAC 2026, a new 501(c)3 dedicated exclusively to AI security, with a 2026 mission of "Securing the Agentic Control Plane" - governing identity, authorization, orchestration, runtime behavior, and trust assurance for autonomous AI agent ecosystems[15].

\n
\n

The Player Map: Four Categories, Different Strengths

\n

The vendor landscape has fragmented into four distinct categories. Understanding what each does - and doesn't do - is essential before buying.

\n
AI Agent Identity: Vendor Category Comparison
CategoryExamplesCore StrengthKey Gap
Identity Providers extending to agentsMicrosoft Entra Agent ID, Okta (MCP server + Auth for MCP), Auth0Standards-based auth (OAuth 2.1/OIDC), existing enterprise trust, lifecycle hooksEcosystem lock-in; heterogeneous agent stacks require federation workarounds
NHI Security SpecialistsOasis Security, Entro, TeleportDiscovery, secrets rotation, posture management for service accounts and API keysAgent governance is identity-discovery-led, not runtime-enforcement-led; agents treated as NHI subset, not first-class
MCP GatewaysArcade, TrueFoundry, Cloudflare Agents SDKRuntime authorization at the tool-call level; per-session ephemeral credentials; low-latency enforcementClosed ecosystems; governance doesn't extend to human identities or non-MCP agents
IGA Platforms governing agents + humansIden, SailPoint (Agent Identity Security add-on), ServiceNow/VezaUnified lifecycle governance across human and non-human identities; policy-driven provisioning and deprovisioning; access reviewsLegacy IGA platforms bolt on agent support; depth and automation vary significantly
\n\n\n\n

A few notes on the landscape:

\n

Identity providers are moving fast. Auth0's "Auth for MCP" became generally available on May 6, 2026, and Okta released its own MCP server as a secure protocol abstraction layer enabling AI agents to interact with Okta's scoped management APIs with least-privilege access control enforced at each tool call[2]. These are authentication solutions. They do not govern the full identity lifecycle.

\n

NHI specialists have the discovery story right. Veza's 2026 State of Identity and Access report found that a mere 0.01% of non-human identities control 80% of cloud resources, while the average worker holds 96,000 entitlements[16]. Knowing that is valuable. Governing it requires more than a posture dashboard.

\n

MCP gateways solve the runtime enforcement problem elegantly for agents you build inside their ecosystem. The problem is coverage: only 23.7% of organizations use their existing IAM/IdP as an authorization server for their agentic MCP infrastructure[3]. The rest are running disconnected auth stacks.

\n

IGA platforms are the natural home for agent governance - if they've actually built it. SailPoint expanded Agent Identity Security connectors in 2026 to include SaaS versions of Salesforce, ServiceNow, and Snowflake, but governance of agent identities requires a separate Agent Identity Security license[17]. Legacy IGA vendors are adding agent support as a module. That's not the same as designing for it from the start.

\n
\n

The Honest Gaps

\n

Standards are immature. The MCP OAuth 2.1 profile is solid for authentication but has no standardized audit trail format. MCP-I / KYA-OS is in active community development with sparse production implementations. The CSA ATF is a governance framework, not an enforcement tool.

\n

The monitoring gap is severe. Only 14.4% of organizations have achieved full IT and security approval for their entire agent fleet, and 88% of organizations reported confirmed or suspected AI agent security incidents in the past year[18]. Only 21.9% of organizations currently treat AI agents as independent, identity-bearing entities within their security model[3]. Most still treat agents as extensions of human users or generic service accounts.

\n

The over-permissioning problem is structural. 70% of security leaders say AI systems have more access than a human in the same role, and 67% of organizations rely on static credentials for AI systems[19]. Static, long-lived credentials are the opposite of what every framework recommends. They persist after an agent's task is complete, survive offboarding, and create the same orphaned-account problem that has plagued human identity governance for decades - just at machine speed.

\n

The CSA-Oasis State of NHI and AI Security 2026 found that 51% of organizations cite over-permissioned access as a top NHI pain point, and 78% have no documented policy for creating or removing AI identities[20].

\n
\"Isometric
\n\n\n\n
\n

What IGA Looks Like When It's Built for This

\n

The governance problem for AI agents is structurally identical to the governance problem for human identities - and for the same reason that IGA exists: access sprawl, orphaned accounts, over-permissioning, and the inability to answer "who has access to what, and should they?" at any given moment.

\n

The difference is velocity and scale. NHIs outnumber human identities 17 to 1 in the average enterprise, and the NHI population grew 44% year-over-year between 2024 and 2025[21]. AI agents are the fastest-growing segment within that already-exploding category. Quarterly access reviews cannot keep pace. Neither can spreadsheets.

\n

What's needed is a single governance plane that treats human and non-human identities with the same policy engine, the same lifecycle automation, and the same access review workflows - without requiring a separate module, a separate license, or a separate team.

\n

That's the design principle behind Iden. Rather than bolting agent governance onto a human-centric IGA platform, or treating agents as a subset of NHI discovery, Iden governs all identity types - employees, contractors, service accounts, bots, and AI agents - through the same policy-driven lifecycle engine. Fine-grained control at the channel, repository, and project level means an agent gets exactly the access its task requires, and that access is revoked when the task is done. No standing permissions. No orphaned agent accounts.

\n

For organizations evaluating where AI agent governance fits in their stack, the 12 Best IGA Vendors in 2026 post maps the full landscape, and our NHI explosion piece covers the scale of the underlying problem in detail.

\n
\n

How to Evaluate Agent Identity Capabilities Today

\n

The standards are immature, the vendor claims are ahead of the implementations, and the threat is real. Here is a practical evaluation framework for buyers.

\n
1
Inventory your agent estate before you buy anything

You cannot govern what you cannot see. Start with a full discovery pass: which agents are running, who deployed them, what credentials they hold, and what systems they can reach. Shadow agents — those with no registry entry, no assigned owner, and no managed identity — are your highest-risk population. Treat them as Critical findings.

2
Demand short-lived, scoped credentials — not API keys

Any platform that relies on shared API keys or long-lived static credentials for agent authentication is not a governance solution. Require per-session ephemeral tokens scoped to the specific task, with automatic teardown at end of session. This is the single highest-leverage control against prompt injection and credential theft.

3
Verify the AND gate, not the OR gate

An agent should only be able to do what the agent is authorized to do AND what the delegating user is authorized to do — not the union of both. Service accounts that inherit broad employee credentials create authorization bypass vulnerabilities. Confirm that your chosen platform enforces the intersection, not the superset.

4
Require a full audit trail at the tool-call level

Logging that an agent 'ran' is not an audit trail. You need: which agent, which user delegated, which tool was called, with what arguments, what data was accessed, and what the result was. The EU AI Act's transparency provisions take effect August 2, 2026. If your platform cannot produce this log on demand, it cannot support compliance.

5
Evaluate lifecycle governance, not just runtime enforcement

Runtime authorization at the tool-call level is necessary but not sufficient. You also need: agent registration and approval workflows before deployment, access reviews on the same cadence as human identities, and automated deprovisioning when an agent is retired. Ask vendors specifically how they handle agent offboarding — most have no answer.

6
Insist on unified governance across human and non-human identities

Separate tools for human IGA and agent governance create blind spots at the seams. An agent acting on behalf of a human should be governed in the same plane as that human — same policy engine, same access review, same audit log. If your IGA platform treats agents as a bolt-on module, you have a coverage gap.

\n\n\n\n
\n

The Bottom Line

\n

The 2026 standards landscape for AI agent identity is real and moving fast - MCP OAuth 2.1 under Linux Foundation governance, MCP-I / KYA-OS at the DIF, Microsoft Entra Agent ID in GA, and the CSA Agentic Trust Framework providing the governance vocabulary. These are genuine milestones.

\n

But standards are not implementations. Only 3% of organizations have automated, machine-speed controls governing AI behavior[19]. The gap between what the frameworks prescribe and what organizations have actually deployed is enormous.

\n

The organizations that close that gap fastest will be the ones that stop treating agent governance as a separate problem from identity governance. Agents are identities. They need the same lifecycle controls, the same access reviews, the same deprovisioning workflows, and the same audit trails as every other identity in your environment - just with shorter-lived credentials and faster policy enforcement.

\n

That's not a new category of tooling. It's IGA, built for the full population of identities your enterprise actually runs.

\n
\n\n\n
  1. microsoft.com — 80 of fortune 500 use active ai agents observability governance and security shape the new frontier
  2. marktechpost.com — Best authentication platforms for ai agents and mcp servers in 2026
  3. gravitee.io — State of ai agent security
  4. workos.com — Everything your team needs to know about mcp in 2026
  5. aaif.io — Mcp is now enterprise infrastructure everything that happened at mcp dev summit north america 2026
  6. prefect.io — Mcp oauth
  7. epinium.com — Model context protocol enterprise guide
  8. vouched.id — Vouched donates mcp i identity framework to the decentralized identity foundation to advance trust and security for ai agents
  9. blog.identity.foundation — Why dif said yes to mcp i
  10. learn.microsoft.com — What is microsoft entra agent id
  11. learn.microsoft.com — Agent identities
  12. microsoft.com — Secure agentic ai end to end
  13. cloudsecurityalliance.org — The agentic trust framework zero trust governance for ai agents
  14. oktsec.com — Csa agentic trust framework zero trust agents
  15. cloudsecurityalliance.org — Csa securing the agentic control plane
  16. veza.com — Forrester recognizes veza for iga ispm and nhi ai identity management
  17. aimultiple.com — Iga solutions
  18. gravitee.io — State of ai agent security 2026 report when adoption outpaces control
  19. cybersecstats.com — Ai cybersecurity statistics 2026 q1 q2
  20. secureflo.net — Ai agent identity management a 2026 ciso playbook
  21. labs.cloudsecurityalliance.org — Csa whitepaper nonhuman identity agentic ai governance v1 cs

Related reading

Segregation of duties

The Definitive Guide to Segregation of Duties (SoD): From Policy to Entitlement-Level Enforcement

A complete SoD guide: definition, toxic combinations, framework mapping (SOC 2, ISO 27001, SOX, PCI DSS), the conflict matrix, and why role-level SoD misses the real violations hiding inside broad entitlements.

Jul 24, 2026
Third-party access audit trail

Third-Party Access Is Your Audit's Weakest Link - Here's How to Fix It

Contractors and partners don't live in your HRIS - so they fall outside JML automation and become orphaned-access hotspots. Here's the evidence every auditor demands and how to produce it.

Jul 17, 2026
Legacy IGA migration

The Legacy IGA Migration Guide: Real Costs, Realistic Timelines, and a Step-by-Step Checklist

Replacing SailPoint IIQ, Oracle, IBM, or One Identity feels terrifying. This guide breaks down the real migration costs, honest timelines, and a step-by-step checklist to de-risk the switch.

Jul 13, 2026
","snapshot_chars":230483,"live_check":"changed"},{"url":"https://hackernoon.com/the-identity-layer-for-ai-agents-is-finally-being-built","committed_hash":"sha256:b484b63e74bcb107b9da4234d355389b963dbc23555ef26526d71e38482410aa","committed_hash_short":"sha256:b484b63e…482410aa","mime_type":"text/html","committed_at":"2026-07-27T09:00:20.621706+00:00","content_snapshot":"
Write
2,419 reads

The Identity Layer for AI Agents Is Finally Being Built

by
\"Gus
byGus Aragón|@garagonFounder at Oktsec.com

Founder @ Oktsec | Security for AI agent work | AAIF Ambassador | Cybersecurity | Open Source

July 11th, 2026
\"Read\"Print\"Read
\"Read\"Print\"Read
\"en-flag\"EN\"ru-flag\"RU\"ko-flag\"KO\"es-flag\"ES\"zh-flag\"ZH\"fr-flag\"FR\"ja-flag\"JA\"hr-flag\"HR\"ps-flag\"PS\"el-flag\"EL\"ca-flag\"CA\"be-flag\"BE\"lo-flag\"LO
\"featured
    Speed
    Voice
\"Gus
\"Gus


In March I published a piece arguing that AI agents don't have identities and that this was already a security crisis. The claim was operational. We were deploying systems that read files, call APIs and chain tools together, while the answer to the most basic security question, who exactly is acting right now, was still a shared account, a reused API key and permissions far broader than any single task required.

Four months later the diagnosis holds. Agent identity is not solved end to end. What changed is that the problem became explicit. Between March and July 2026 it showed up in protocol releases, enterprise features and papers with measured results. The identity layer for AI agents is finally being built. It just isn't finished.

\n

A2A grew up first

\n

The first milestone landed almost on top of my original article. On March 12, the A2A project shipped v1.0.0, its first stable specification. The release touches security directly: it removes the legacy OAuth implicit and password flows, adds Device Code (RFC 8628) and PKCE support, introduces native multi-tenancy, adds mTLS to the security schemes and formalizes Agent Card signature verification using JWS and JSON Canonicalization.

\n

The signed Agent Cards are the piece I care about most. In v0.x, an Agent Card was self-declared metadata. Any agent could claim to be anything. With v1.0, clients can cryptographically verify agent identity and metadata before trusting an interaction across organizational boundaries. The spec also formalizes in-task authorization through the TASK_STATE_AUTH_REQUIRED state, which gives agents a standard fallback when an operation needs human or client approval mid-flight.

\n

The limitation is that Agent Cards remain a declarative layer. The signature proves who published the card. It says nothing about what a specific running instance of that agent is doing right now, or under whose delegated authority. Identity per instance, portable across heterogeneous stacks, still doesn't exist in the spec.

\n

MCP put authorization at the center

\n

MCP moved on a different front. On March 9, the maintainers published their 2026 roadmap, acknowledging that the protocol had outgrown its "connect local tools" phase and was now production infrastructure with governance to match. In April the project expanded its maintainer team, citing the move to the Agentic AI Foundation and a growing volume of Specification Enhancement Proposals. When a protocol starts adding lead maintainers to handle SEP throughput, it has stopped being an experiment.

\n

On May 21, the maintainers published the release candidate for MCP 2026-07-28 and described it as the largest revision since launch. It brings a stateless core, Tasks and MCP Apps as extensions, a formal deprecation policy and six SEPs hardening authorization to align with how OAuth 2.0 and OpenID Connect actually get deployed in production, including issuer validation per RFC 9207.

\n

The most tangible piece landed on June 18, when Enterprise-Managed Authorization went stable. EMA lets organizations control MCP server access centrally through their identity provider. Users log in once and inherit access to every approved server, with no per-app OAuth consent screens. Okta is the first supported IdP through Cross App Access. Anthropic implemented it across Claude, Claude Code and Cowork, Microsoft shipped it in VS Code, and MCP servers from Asana, Atlassian, Figma, Linear and Supabase support it at launch.

\n

EMA fixes something real. Before it, the typical enterprise pattern was a shared service account with a long-lived token in a .env file. No audit trail, no role scoping, no revocation path. EMA replaces that with IdP-governed access: group membership, conditional access rules, deprovisioning on offboarding. For anyone running agents in an enterprise, this is the most important practical improvement since my original article.

\n

What EMA answers is which humans in this org may connect to which servers. What it doesn't answer is which agent instance received which delegated authority to perform which specific action inside a chain of tools. Provisioning and governance improved dramatically. Per-action, per-instance identity did not.

\n

Research went where the protocols don't reach

\n

While the protocols hardened their edges, academic work attacked the middle. Two papers stand out.

\n

PAuth (arXiv 2603.17170, March 17) goes straight at overprivilege. Its argument: OAuth scopes are bound to operators, not operations. If your agent needs to transfer $100 to Bob, OAuth forces you to grant a blanket TRANSFER permission that covers any amount to any recipient. PAuth proposes task-scoped implicit authorization instead. Submitting a natural-language task authorizes only the concrete operations required to execute it faithfully. In the AgentDojo evaluation, all benign tasks complete without extra permissions and all injected attack operations trigger warnings, with zero false positives and zero false negatives. This is the operation-level policy layer I sketched in March, now with a working prototype.

\n

AIP (arXiv 2603.24775, March 25) is the most direct confirmation of the original thesis. The paper states that neither MCP nor A2A natively verifies agent identity, and cites a Knostic scan of roughly 2,000 internet-exposed MCP servers in which every single one lacked authentication. Its answer is Invocation-Bound Capability Tokens: an append-only chain that fuses identity, attenuated authorization and provenance into one cryptographic artifact, with bindings for MCP, A2A and plain HTTP. The measured overhead is 2.35ms in a real multi-agent deployment, 0.086% of end-to-end latency, with a 100% rejection rate across 600 adversarial attempts. AIP is now also an IETF Internet-Draft, which tells you where this conversation is heading.

\n

Around these two, a broader research cluster is forming: decentralized identity approaches built on DIDs and verifiable credentials, IETF drafts on attenuating authorization tokens for delegation chains, and work reframing the problem from "who are you" to "what portable authority can you prove". None of it is deployed at scale. All of it targets the layers the protocols still leave open.

\n

Scoring my March claims

\n

The original article made five claims. This is how they held up.

\n

Agents don't fit the identity models for humans, services or bots. Confirmed. Every serious paper published since starts from this exact insufficiency and proposes agent-specific frameworks.

\n

Delegation on behalf of a user is badly modeled*.* Confirmed, with nuance. MCP's authorization is still built on standard OAuth 2.1 flows. EMA improves the enterprise operation of those flows enormously without introducing universal agentic identity. Better plumbing, same conceptual gap.

\n

Multi-tool composition creates emergent privileges nobody approved. Confirmed and expanded. MCP elevated tool annotations as a risk vocabulary, threat modeling work flagged tool poisoning as a critical client-side vulnerability, and A2A added in-task authorization. The ecosystem now agrees this is where attacks live.

\n

You can't reliably audit who did what*.* Partially mitigated. Signed Agent Cards and AIP-style completion records add provenance. There is still no dominant standard for per-instance audit across stacks.

\n

The fix is a layered stack, not a single patch. Confirmed. MCP is building the authorization layer. A2A is building declarative identity and inter-agent trust. Research is building task scoping, verifiable delegation and portable authority. Nobody is shipping one magic fix, because there isn't one.

\n

The right question for July 2026

\n

The question is no longer whether agents have an identity crisis. They do, and now everyone from protocol maintainers to IETF draft authors says so in writing. The right question is which parts of the stack finally exist and which parts remain aspirational.

\n

My answer today: enterprise authorization for MCP exists and works. A serious foundation for inter-agent trust exists in A2A v1.0. Measured proposals exist for task scoping and verifiable delegation. What still doesn't exist is the layer that binds them into an interoperable default: identity per running instance, authority that attenuates correctly across multi-hop delegation and provenance you can audit end to end without trusting every intermediary.

\n

In March I wrote that the best time to close this gap was before deployment, and the second best time was now. That line deserves an update. We're no longer starting from zero. We're starting from an ecosystem that finally admits, in specs and in code, that an agent can't keep being treated as a weird user or as just another service. An agent needs verifiable identity, bounded authority and auditable provenance. Until that's the default behavior in production, the crisis hasn't ended. It has started to professionalize.

\n
\n

References

\n\n



About Author

\"Gus
byGus Aragón|@garagon
Founder at Oktsec.com

Founder @ Oktsec | Security for AI agent work | AAIF Ambassador | Cybersecurity | Open Source

Read my storiesAbout @garagon

TOPICS

cybersecurity
#ai-agents#ai-security#a2a-protocol#mcp-server#ai-agent-identity#oauth-2.1#enterprise-ai#hackernoon-top-story

Light-Mode

Classic

Newspaper

Proof of Usefulness

Dark-Mode

Neon Noir

Minty

Startups of the Year

","snapshot_chars":147303,"live_check":"changed"}]}