{"slug":"ietf-opens-the-door-to-standardizing-agent-to-agent-communication","citations":[{"url":"https://nerdleveltech.com/ietf-ai-agent-protocol-standard-agentproto","committed_hash":"sha256:13474fa9cefa73091f0074d443ff54b62054c17b8b0d378f2d625bcc226294cb","committed_hash_short":"sha256:13474fa9…226294cb","mime_type":"text/html","committed_at":"2026-07-26T10:00:28.632871+00:00","content_snapshot":"IETF Weighs an AI Agent Protocol Standard in 2026 | Nerd Level Tech
NerdLevelTech
ai-ml

IETF Weighs an AI Agent Protocol Standard in 2026

July 24, 2026

#IETF#AI agent protocol#agentproto#MCP#A2A#agent interoperability#agentic ai
\"IETF

In one line: At IETF 126 in Vienna this week, a Birds-of-a-Feather session called agentproto asked whether the internet's standards body should define how AI agents talk to each other across organizations — the gap that today's dominant protocols, MCP and A2A, leave open.1

\n

TL;DR: For more than a year, vendors shipped competing AI agent protocols — Anthropic's MCP, Google's A2A, and several more — and none of them cleared the one bar that makes a protocol interoperable across organizational boundaries: an IETF RFC. On Thursday, July 23, the agentproto Birds-of-a-Feather (BoF) session at IETF 126 in Vienna brought that question into the Internet Engineering Task Force, with a view toward chartering a Working Group.1 This is not a vote and not a product launch; the IETF works by rough consensus, and any resulting standard is years away.2 What is genuinely new is that agent-to-agent communication is now being treated as an internet-infrastructure problem, not just a vendor feature.

\n

What you'll learn

\n
    \n
  • What happened at the agentproto BoF at IETF 126, and what a \"Birds-of-a-Feather\" session actually decides
    • \n
  • Why the IETF works by rough consensus rather than a vote — and why that framing matters here
    • \n
  • How MCP and A2A differ, and the interoperability gap neither one closes
    • \n
  • The specific problems the underlying framework draft says still need a standard
    • \n
  • Why prompt injection is the security test any agent protocol standard has to pass
    • \n
  • The realistic timeline from a BoF to a published RFC, and what to watch next
    • \n
\n

What happened at the agentproto BoF

\n

The IETF 126 meeting ran 18–24 July 2026 in Vienna, and among the established Working Group sessions the organization scheduled five Birds-of-a-Feather sessions — early, community-wide discussions about work that might be ready for the IETF to take on.1 Three of the five touched AI agents directly. The one with the highest stakes for anyone building multi-agent systems was agentproto (Agent Communication Protocols), held Thursday, 23 July, 09:00–11:00 CEST.1

\n

The IETF's own framing is precise: the past year produced \"a rush of competing, overlapping protocols for connecting AI agents to one another and to the tools they use — Model Context Protocol (MCP), Agent2Agent (A2A), the Agent Communication Protocol (ACP), the Agent Network Protocol (ANP), and more.\" The agentproto session, it says, \"brings that conversation into the IETF,\" building on a well-attended IETF 124 side meeting and on framework and requirements work led by Jonathan Rosenberg and Cullen Jennings, \"with a view toward chartering a Working Group to take that work forward.\"1

\n

That phrase — chartering a Working Group — is the actual object of the meeting. A BoF is not where a standard gets written. It is where the community decides whether there is enough consensus, energy, and a tight enough scope to justify starting the multi-year process that eventually produces one.2

\n

Why it is rough consensus, not a vote

\n

It is tempting to describe Thursday's session as a vote on an IETF AI agent protocol standard. That is the wrong mental model, and the distinction is not pedantic. The IETF does not decide by counting ballots. It decides by \"rough consensus and running code\" — a working agreement in the room and on the mailing list, backed by implementations that actually run.2 A BoF that is \"working-group-forming,\" as agentproto aims to be, succeeds when it demonstrates that a coherent problem and a willing community exist; it can just as easily send the work back to the mailing list if the discussion reveals too much disagreement about scope.2

\n

This is why an IETF outcome carries weight that a vendor announcement does not. The RFCs that came out of this process define TLS, DNS, and the transport underneath modern web traffic, and they endure precisely because they were not imposed by one company. If the IETF eventually charters an agent-protocol Working Group, it is asserting that an IETF AI agent protocol standard belongs in the same category as those foundational specifications — an internet-layer concern rather than a product-layer one. As of this writing, the formal result of Thursday's session — whether a Working Group is chartered — follows that consensus process; session materials and minutes are posted to the IETF Datatracker as they are finalized, and that is the authoritative place to confirm the outcome rather than early press summaries.

\n

MCP vs A2A: two layers, one missing piece

\n

To see why the IETF is interested at all, you have to see what the existing protocols do and do not cover. They are not really competitors so much as neighbors solving different halves of the problem.

\n

MCP (Model Context Protocol) is a client-server protocol: an agent reaches out to a tool, database, or API and requests data or an action. Anthropic donated MCP to the Agentic AI Foundation — a directed fund under the Linux Foundation — on 9 December 2025, and by that point the protocol reported \"over 97 million monthly SDK downloads, 10,000 active servers,\" with first-class client support across ChatGPT, Claude, Cursor, Gemini, Microsoft Copilot, and Visual Studio Code.3 Its next revision, the 2026-07-28 spec, is the largest since launch and, among other things, realigns authorization with OAuth 2.1; we covered that change in depth in our write-up of MCP's stateless 2026-07-28 spec.4

\n

A2A (Agent2Agent) is a peer-to-peer protocol: two agents discover each other's capabilities and delegate tasks. Google donated A2A to the Linux Foundation on 23 June 2025 at Open Source Summit North America, with Amazon Web Services, Cisco, Microsoft, Salesforce, SAP, and ServiceNow among the founding members; the coalition has since grown to over 100 technology companies.56 If you want the hands-on version of how agents advertise capabilities and hand off work, our A2A protocol tutorial walks through it.

\n
\n\n

Here is the gap. MCP standardizes the agent-to-tool link. A2A standardizes the agent-to-agent link within a broadly cooperating ecosystem. Neither one fully specifies what happens when an agent in your organization needs to prove to an agent in someone else's organization that it is authorized to act on a user's behalf — and to do so in a way both sides can verify without a prior bilateral integration. That cross-domain, no-prior-trust case is exactly the territory internet standards exist to cover.

\n

The problems the framework says still need a standard

\n

The intellectual basis for agentproto is a framework and requirements document authored by Jonathan Rosenberg, of Five9, and Cullen Jennings, of Cisco.7 Rosenberg's involvement is a signal in itself: he is a lead author of RFC 3261, the Session Initiation Protocol that governs much of the internet's real-time voice and video. One procedural caveat worth stating plainly: an Internet-Draft is a proposal, not a standard. The datatracker attaches an explicit disclaimer that such drafts are \"not endorsed by the IETF\" and have \"no formal standing in the IETF standards process,\" and the early framework draft has already been superseded — the current document is draft-rosenberg-agentproto-usecases.78

\n

With that caveat, the framework's argument is that today's protocols leave a short list of hard problems unsolved, and that these are the ones worth standardizing. Its requirements sections map to them directly: discovery (how agents find each other, especially across domains), authentication and authorization (how identity and credentials are federated so one organization's agent can be trusted by another's), lifecycle management (how a chain of delegated agents is managed across the life of a task), and user confirmation (how a human stays in the loop before an action such as booking a flight is committed).7 The draft frames agent communication as a new application-layer concern — occupying the same tier of the internet stack as HTTP, SIP, and RTP do today.7

\n

Why prompt injection is the security test

\n

The most concrete technical argument for standardizing this at the protocol layer is a security one, and it centers on prompt injection.

\n

In a single-agent system, prompt injection means a user crafts input that overrides the agent's instructions. OWASP ranks it as LLM01 — the number-one risk in its Top 10 for LLM Applications.9 The multi-agent version is structurally worse. A malicious user can craft input for Agent A that is really aimed at Agent B, the agent that A calls next. Because A relays user content to B as part of normal operation, and because B trusts A, the injected instruction can ride the trust relationship straight past A's defenses.7 The framework's position is blunt: prompt injection is notoriously difficult to prevent, so the protocol-level answer is not prevention but attribution — mechanisms for logging, diagnosis, and reconstructing which agent did what when an incident happens.7

\n

That is a requirement no purely application-level defense can satisfy, because the attack crosses a boundary between two independently operated systems. It is also the clearest illustration of why \"just use MCP and A2A\" is not a complete answer: neither was designed to carry incident attribution across an inter-domain agent cascade.

\n

The realistic timeline — and what to watch

\n

Set expectations accordingly. The IETF process is deliberately slow: a proposal typically moves from a BoF, to a chartered Working Group, through multiple Internet-Draft revisions and reviews, to a published RFC — a path that commonly takes on the order of two to four years.10 Nothing shipped in Vienna this week. What the meeting could produce is a decision to start, and that decision then shapes what the RFC pipeline looks like in 2027 and 2028.

\n

The strategic question underneath is whether an open IETF AI agent protocol standard will define inter-domain agent communication, or whether the market-dominant protocols will harden into de facto standards by deployment momentum alone. MCP's 97-million-downloads-a-month adoption is a real gravitational field, and it is entirely possible that the practical baseline gets set by what is already deployed rather than by what the IETF eventually blesses.3 The tension between those two outcomes is the story worth following. It is also the same interoperability-versus-lock-in tension that regulators are pressing from a different direction, as we covered in the EU's push for AI agent interoperability under the DMA.

\n

For now, the honest status is: the conversation has arrived at the IETF, the problem statement is well-formed, and the outcome of Thursday's session is a matter of public record on the IETF Datatracker rather than of speculation.

\n\n\n\n\n\n\n\n\n\n\n\n

Frequently Asked Questions

Not yet. At IETF 126 in Vienna, the agentproto Birds-of-a-Feather session opened the question of whether the IETF should charter a Working Group to standardize agent-to-agent communication.1 A BoF is an exploratory step, not a standard; even if a Working Group is chartered, a published RFC is typically two to four years out.10 The authoritative outcome of the session is posted to the IETF Datatracker.

Continue Learning

Related Posts

\"Adobe

Adobe + Claude: 50+ Creative Tools From One Prompt

claudeadobe
\"Claude

Claude Managed Agents: Build Production AI Agents in Days

anthropicclaude
\"Pinecone

Pinecone Nexus: Is RAG Ending for AI Agents? (2026)

Pinecone Nexusknowledge engine
\"Prompt

Prompt Optimization for AI Agents: GEPA and DSPy (2026)

prompt optimizationGEPA
","snapshot_chars":265335,"live_check":"changed"},{"url":"https://thenextweb.com/news/google-cloud-next-ai-agents-agentic-era","committed_hash":"sha256:85b2d47e7fbe77853cfb98cf533e7febaad59243b136d7a3d3248fb4e8474a1e","committed_hash_short":"sha256:85b2d47e…e8474a1e","mime_type":"text/html","committed_at":"2026-07-26T10:00:28.870777+00:00","content_snapshot":"\n\n\n\n \n \n \n \n \n \n \n\n \n \n \n \n\n \n \n \n \n \n \n Google Cloud Next 2026: AI agents, A2A protocol, Workspace Studio, and the full-stack bet against OpenAI and Anthropic\n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n\n\n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n \n\n \n \n \n\n \n\n \n \n\n \n\n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n\n \n \n \n \n \n \n \n \n \n \n \n \n Skip to content\n\n \n\n
\n
\n\n \n
\n
\n \n \n \n \n
\n \n
\n
\n\n
\n

This article was published on April 22, 2026

\n
\n \n\n \n
\n
\n
\n \n\n

\n Google just launched its agentic enterprise play, and it runs from chip to inbox\n

\n\n \n
\n\n
\n \n
\n
\n\n \n
\n
\n \n
\n\n
\n
\n
\n\n \n \n
\n
\n
\n
\n \n \n \n\n Image by: Google\n \n
\n
\n \n
\n \n \n \n \n\n \n
\n
\n

Summary: Google rebranded and consolidated its AI platform at Cloud Next 2026, renaming Vertex AI to the Gemini Enterprise Agent Platform and absorbing Agentspace into a unified Gemini Enterprise product. The announcements include Workspace Studio (no-code agent builder), 200+ models in the Model Garden including Anthropic Claude, partner agents from Box, Workday, Salesforce, and ServiceNow, ADK v1.0 stable releases across four languages, Project Mariner (web-browsing agent), managed MCP servers with Apigee as an API-to-agent bridge, and A2A protocol v1.0 in production at 150 organisations. Kurian framed the strategy as owning the full stack from chip to inbox while competitors “hand you the pieces, not the platform.”

\n

 

\n

Google used the opening keynote of Cloud Next 2026 on Tuesday to unveil what amounts to a full rebranding and consolidation of its AI platform around agents. Vertex AI is now the Gemini Enterprise Agent Platform. Google Agentspace, the employee-facing AI assistant, has been absorbed into a unified product called Gemini Enterprise. The announcements span a no-code agent builder for Google Workspace, a redesigned developer platform with more than 200 models including third-party options such as Anthropic’s Claude, a web-browsing agent called Project Mariner, managed MCP servers across Google Cloud services, and the production-grade Agent2Agent protocol for cross-platform agent communication. Thomas Kurian, Google Cloud’s chief executive, titled the keynote “The Agentic Cloud” and drew a deliberate contrast with competitors: other vendors, he said, are “handing you the pieces, not the platform,” leaving teams to integrate components themselves.

\n

The timing is deliberate. OpenAI’s Operator is scoring 87% on complex browser task benchmarks and the company has recruited Cognizant and CGI to push its Codex coding agent into enterprise software shops, with enterprise revenue now accounting for 40% of OpenAI’s total. Anthropic has launched a marketplace for Claude-powered enterprise tools and its Model Context Protocol has reached 10,000 servers and 97 million monthly SDK downloads. Google is fighting from third position in cloud market share, behind AWS and Microsoft Azure, but exited the fourth quarter of 2025 with the fastest growth rate of the three at 50% year on year, and is betting that vertical integration, owning the model, the runtime, the silicon, and the distribution channel through Workspace, gives it an advantage neither competitor can replicate.

\n

The agent stack

\n

TNW City Coworking space - Where your best work happens

A workspace designed for growth, collaboration, and endless networking opportunities in the heart of tech.

\n Book a tour now\n

Google Workspace Studio is the most consumer-facing announcement. It is a no-code platform that lets business users build and deploy AI agents across Gmail, Docs, Sheets, Drive, Meet, and Chat by describing automations in plain language. A user can type “every Friday, ping me to update my tracker” and Gemini creates the automation. Workspace Studio connects to third-party applications including Asana, Jira, Mailchimp, and Salesforce, and can call external APIs via webhooks or run custom logic through Apps Script. It is rolling out to Google Workspace business, enterprise, and education customers.

\n

The developer-facing platform, now called the Gemini Enterprise Agent Platform, received deeper upgrades. Agent Designer, a visual flow canvas for building agent workflows, is in preview. Agent Engine Sessions and Memory Bank, which give agents persistent context across interactions, are generally available. A new Agent Garden provides prebuilt agent solutions for customer service, data analysis, and creative tasks. A free tier via Express mode lowers the entry barrier. The Model Garden now hosts more than 200 models spanning Google’s own Gemini and Gemma families, third-party models including Anthropic Claude, and open models such as Llama. Google also announced six new agents for data engineering and coding in BigQuery, including a data engineering agent that automates pipeline creation from natural language prompts and a code interpreter that translates queries into executable Python with visualisations. Partner agents from Box, Workday, Salesforce, ServiceNow, Dun and Bradstreet, and S&P Global are integrated into the platform, giving enterprise customers prebuilt capabilities for document intelligence, HR self-service, IT operations, and financial data.

\n

Project Mariner, Google DeepMind’s web-browsing agent powered by Gemini 2.0, scores 83.5% on the WebVoyager benchmark and handles ten concurrent tasks on cloud-based virtual machines. It automates shopping, information retrieval, and form-filling, and is available to Google AI Ultra subscribers in the United States. The roadmap includes a visual builder called Mariner Studio in the second quarter, cross-device synchronisation in the third quarter, and an agent marketplace in the fourth quarter.

\n

The protocol play

\n

The most strategically significant announcement may be the least visible to end users. Google’s Agent2Agent (A2A) protocol, originally launched with more than 50 technology partners, has reached 150 organisations in production, not pilot, routing real tasks between agents built on different platforms. The protocol is now governed by the Linux Foundation’s Agentic AI Foundation and has reached version 1.2, with signed agent cards using cryptographic signatures for domain verification. Microsoft, AWS, Salesforce, SAP, and ServiceNow are running A2A in production environments.

\n

A2A is designed to complement rather than compete with Anthropic’s Model Context Protocol (MCP). MCP handles how an agent connects to tools and data sources. A2A handles how agents communicate with each other across organisational and platform boundaries. Google adopted MCP across its own services in December 2025, launching fully managed remote MCP servers for Google Maps, BigQuery, Compute Engine, and Kubernetes Engine, with Cloud Run, Cloud Storage, AlloyDB, Cloud SQL, Spanner, Looker, and Pub/Sub on the roadmap. Apigee, Google’s API management platform, now functions as an MCP bridge, translating any standard API into a discoverable agent tool with existing security and governance controls. Google is simultaneously positioning A2A as the standard for the layer above: the orchestration of multiple agents from multiple vendors working together on a single task.

\n

The practical implication is that a Salesforce agent built on Agentforce can hand off a task to a Google agent running on Vertex AI, which can query a ServiceNow agent for IT asset data, all through A2A without any of the three systems needing to understand each other’s internal architecture. Native A2A support is now built into Google’s Agent Development Kit, LangGraph, CrewAI, LlamaIndex Agents, Semantic Kernel, and AutoGen. Google’s open-source Agent Development Kit reached stable v1.0 releases across Python, Go, and Java, with TypeScript support also available. It is a code-first framework optimised for Gemini but model-agnostic and deployable to any container or Kubernetes environment. The security layer includes Model Armor for defence against indirect prompt injection, zero-trust architecture applied to decentralised agent systems, and access management through Google Cloud IAM with audit logging.

\n

The competitive landscape

\n

OpenAI’s own enterprise agent push through Codex and systems integrator partnerships has reached three million weekly users. Anthropic’s enterprise marketplace for Claude-powered tools is building an ecosystem through partners including Snowflake. Microsoft’s Copilot is embedded in virtually every Fortune 500 company. AWS has Bedrock with its own agents framework maturing rapidly. The enterprise AI agent market is not a two-horse race. It is a five-way contest in which each competitor has a structural advantage the others lack.

\n

OpenAI has the strongest consumer brand and the most advanced reasoning models. Anthropic has the most trusted safety positioning and the fastest-growing enterprise revenue. Microsoft has the deepest enterprise distribution through Office and Azure. AWS has the largest cloud infrastructure base and the strongest developer gravity. Google’s argument is that it is the only company that owns all four layers of the stack: the custom silicon (Ironwood TPUs), the frontier models (Gemini), the cloud platform (now unified as the Gemini Enterprise Agent Platform), and the enterprise distribution channel (Workspace with more than three billion users across Google’s productivity tools). Kurian framed the strategy explicitly: “If you want to adopt a technology successfully, you need to pick a few important projects and do them well, rather than spraying on a lot of little projects.” No other competitor controls the full vertical from chip to application.

\n

Google’s own AI Agent Trends report, published ahead of the conference, found that 89% of business teams are already using AI agents and the average organisation runs 12. The most common enterprise use cases are customer service at 49%, marketing at 46%, security operations at 46%, and IT support at 45%. Early customer deployments suggest the productivity claims are not purely theoretical: Danfoss, the Danish industrial manufacturer, automated 80% of transactional decisions in email-based order processing using Google’s agents, reducing response times from 42 hours to near real-time. Suzano, a Brazilian pulp and paper company, built an agent with Gemini Pro that translates natural language into SQL queries, cutting query time by 95% for 50,000 employees.

\n

The model foundation

\n

The agents run on Google’s Gemini model family, with the Gemini 2.5 generation being retired in October in favour of the 3.x line. Gemini 3 Pro and Gemini 3 Flash, released in late 2025 and iterated through early 2026, provide the reasoning backbone. Gemini 3 Flash delivers a 15% improvement in overall accuracy over Gemini 2.5 Flash and is optimised for high-frequency agentic workflows and real-time processing. Gemini 3.1 Pro, the most advanced reasoning variant, is available in preview. A new experimental model, GLM 5, targets complex systems engineering and long-horizon agentic tasks through the Model Garden. Gemini 3.2 is expected to be formally announced during the conference, with an expanded context window beyond one million tokens and optimised parameter counts for reduced inference latency. Demis Hassabis, DeepMind’s chief executive, stated in January that his team is “focusing on Gemini 4 this year.” Google also recently launched Gemma 4 open models under Apache 2.0 licensing, built from the same research as Gemini 3 and providing an open-weight alternative for enterprise customers who need to run models on their own infrastructure.

\n

The infrastructure beneath the models is equally central to the pitch. Ironwood, Google’s seventh-generation TPU announced the same day, delivers 4.6 petaFLOPS per chip and scales to 9,216-chip superpods producing 42.5 exaFLOPS. Anthropic has committed to up to one million Ironwood units. The custom silicon means Google can offer inference at costs that customers buying Nvidia GPUs at retail cannot match, which in a market where inference is the dominant and growing expense, translates directly into pricing power for the agent services that run on top.

\n

Google Cloud holds roughly 11% of the cloud infrastructure market. AWS holds 31%. Azure holds 25%. The gap is significant and Cloud Next will not close it. But the agentic era, if it materialises at the scale Google is projecting, reshuffles the competitive dynamics in ways that favour a company with a vertically integrated stack over companies that assemble their AI capabilities from multiple vendors. Google is betting that the enterprise customer who adopts AI agents at scale will choose the platform where the model, the runtime, the silicon, the governance, and the productivity suite are all built by the same company and optimised to work together. It is a large bet. Cloud Next 2026 is where Google is asking enterprises to take it.

\n
\n\n \n\n
\n

Get the TNW newsletter

\n

Get the most important tech news in your inbox each week.

\n
\n
\n\n
\n
\n

\n
\n
\n \n \n
\n
\n Published \n
\n\n Back to top\n
\n\n \n
\n \n\n \n
\n
\n
\n\n \n\n \n
\n\n \n
\n
\n \n\n \n\n \n \n \n\n \n \n\n","snapshot_chars":119119,"live_check":"changed"},{"url":"https://articles.idenhq.com/ai-agent-identity-management-2026","committed_hash":"sha256:58ac4b83adda607543a30574244044143450b9aa2aafcbf61cc71de9e8b4fccf","committed_hash_short":"sha256:58ac4b83…e8b4fccf","mime_type":"text/html","committed_at":"2026-07-26T10:00:30.578605+00:00","content_snapshot":"AI Agent Identity Management 2026: Standards & Gaps | Iden Blog
Book demo
Field NotesPlaybooks
LoginBook demo
BlogAuf Deutsch lesen

AI Agent Identity Management in 2026: Standards, Players, and the Governance Gap

MCP OAuth 2.1, MCP-I at the DIF, Microsoft Entra Agent ID - the 2026 standards landscape for AI agent identity is taking shape. Here's what's real, what's missing, and how to evaluate governance today.

10 min read · Last updated July 2026

The numbers are no longer theoretical. More than 80% of Fortune 500 companies now run active AI agents built with low-code and no-code tools[1], and Gartner projects that up to 40% of enterprise applications will include integrated task-specific AI agents by the end of 2026, up from less than 5% today[2]. Yet the security posture underneath that deployment wave is alarming: on average, only 47.1% of an organization's AI agents are actively monitored or secured[3]. The other half operate without oversight, logging, or identity controls.

\n

This is not a future problem. It is the current state of your production environment.

\n

The good news - if you can call it that - is that the standards community has noticed. In the first half of 2026, more governance specifications landed for AI agent identity than in the entire prior history of the field. This post maps what those standards actually say, which vendor categories are responding, where the real gaps remain, and what a buyer should demand today.

\n
\n

The Standards Landscape: What's Actually Shipping

\n

MCP OAuth 2.1 Under Linux Foundation Governance

\n

The Model Context Protocol started as an Anthropic experiment in November 2024. By December 2025, Anthropic had donated MCP to the Agentic AI Foundation (AAIF) under the Linux Foundation, with OpenAI, Block, AWS, Google, Microsoft, Cloudflare, and Bloomberg joining as founding or platinum members[4]. Within four months, the AAIF grew to 170 member organizations - more than double the membership CNCF had at the same stage of its life[5].

\n

The governance shift matters for enterprise buyers. MCP is no longer a single-vendor protocol that any one company can deprecate or fork. It is now closer in structure to CNCF than to a proprietary API.

\n

On authentication specifically: the MCP spec mandates OAuth 2.1 with PKCE for all protected HTTP-based deployments, requiring HTTPS on all endpoints and discoverable authorization server metadata[6]. The 2026 roadmap, published in March, makes enterprise readiness - including audit trails, SSO-integrated auth, and configuration portability - a top priority. The spec's authorization Working Group had six dedicated sessions at the April 2026 MCP Dev Summit, with the OAuth 2.1 spec author present.

\n

The 2026 MCP roadmap flagged audit trail infrastructure, SSO-integrated auth, and configuration portability as the top enterprise requests[7]. None of those are solved yet. The roadmap is a commitment, not a delivery.

\n
warning Warning

The authentication gap is real. Research published in early 2026 documented more than 1,800 active MCP servers on the public internet with no authentication whatsoever. Because authentication in MCP is optional — not required by the spec — they are technically compliant and practically insecure. Before deploying any MCP server, verify OAuth 2.1 is enabled and enforced, not just installed.

\n\n\n\n

MCP-I / KYA-OS: Decentralized Identity for Agents

\n

OAuth 2.1 handles authentication - proving an agent is who it claims to be. It does not answer the harder questions: Who authorized this agent? What is it allowed to do on behalf of which human? Can a downstream service verify that chain without prior coordination?

\n

In March 2026, Vouched formally donated the Model Context Protocol - Identity (MCP-I) framework to the Decentralized Identity Foundation (DIF), where it is now stewarded by the DIF Trusted AI Agents Working Group[8]. The spec has since been renamed KYA-OS (Know Your Agent Operating System) to reflect its scope beyond MCP alone.

\n

MCP-I / KYA-OS uses Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) to enable cryptographically secure verification of both agents and their human principals - without requiring prior coordination between parties[9]. The framework defines four identity questions every service should be able to answer: Who is the agent? Who authorized it? What is it allowed to do? What is the scope of that delegation?

\n

This is the right architecture for multi-organization agent workflows - a travel booking agent acting on behalf of a user across airline, hotel, and payment systems, for example. It is also early. The spec is in active community development, and production implementations are sparse.

\n

Microsoft Entra Agent ID

\n

Microsoft moved fastest among the major identity platforms. Microsoft Entra Agent ID introduces agent identities as a distinct, purpose-built construct - not a repurposed service principal or user account - with agent identity blueprints serving as templates for creating individual agent identities with parent-child relationships[10].

\n

Agent identities in Entra do not have credentials of their own; they rely on the agent identity blueprint to acquire tokens on their behalf, and they only authenticate using federated identity credentials[11]. This is the right model: credentials live in the blueprint, not on the agent, so a compromised agent cannot exfiltrate its own keys.

\n

Microsoft Agent 365, generally available from May 1, 2026, gives each AI agent its own Entra Agent ID for identity, lifecycle, and access management, and integrates with Conditional Access, identity protection, and Microsoft Purview[12]. Third-party agents from AWS Bedrock, n8n, and other frameworks can be onboarded via workload identity federation - no platform-specific credential management required.

\n

The honest limitation: Entra Agent ID is a strong solution if your agent estate lives inside the Microsoft ecosystem. For organizations running heterogeneous stacks - Anthropic, AWS, open-source frameworks, and custom-built agents - the governance surface extends well beyond what any single IdP can cover.

\n

CSA Agentic Trust Framework and CSAI Foundation

\n

The Cloud Security Alliance has been the most prolific standards producer in this space. The CSA published the Agentic Trust Framework (ATF) on February 2, 2026 - the first governance specification applying Zero Trust principles to autonomous AI agents with a structured maturity model[13]. The ATF was co-authored by John Kindervag, the original creator of Zero Trust.

\n

A companion survey of 285 IT and security professionals makes the urgency concrete: 84% of organizations cannot pass a compliance audit focused on agent behavior or access controls, and only 23% have a formal agent identity strategy[14].

\n

The CSA's MAESTRO threat modeling framework explicitly names agent impersonation as a distinct threat class - malicious actors deceiving users or other agents by impersonating legitimate AI agents. The prescribed mitigations are trusted agent registries, cryptographic agent identities, and short-lived OAuth/OIDC tokens scoped to the intersection of what the agent is allowed to do AND what the delegating user is allowed to do. An AND gate, not an OR gate.

\n

In March 2026, the CSA launched the CSAI Foundation at RSAC 2026, a new 501(c)3 dedicated exclusively to AI security, with a 2026 mission of "Securing the Agentic Control Plane" - governing identity, authorization, orchestration, runtime behavior, and trust assurance for autonomous AI agent ecosystems[15].

\n
\n

The Player Map: Four Categories, Different Strengths

\n

The vendor landscape has fragmented into four distinct categories. Understanding what each does - and doesn't do - is essential before buying.

\n
AI Agent Identity: Vendor Category Comparison
CategoryExamplesCore StrengthKey Gap
Identity Providers extending to agentsMicrosoft Entra Agent ID, Okta (MCP server + Auth for MCP), Auth0Standards-based auth (OAuth 2.1/OIDC), existing enterprise trust, lifecycle hooksEcosystem lock-in; heterogeneous agent stacks require federation workarounds
NHI Security SpecialistsOasis Security, Entro, TeleportDiscovery, secrets rotation, posture management for service accounts and API keysAgent governance is identity-discovery-led, not runtime-enforcement-led; agents treated as NHI subset, not first-class
MCP GatewaysArcade, TrueFoundry, Cloudflare Agents SDKRuntime authorization at the tool-call level; per-session ephemeral credentials; low-latency enforcementClosed ecosystems; governance doesn't extend to human identities or non-MCP agents
IGA Platforms governing agents + humansIden, SailPoint (Agent Identity Security add-on), ServiceNow/VezaUnified lifecycle governance across human and non-human identities; policy-driven provisioning and deprovisioning; access reviewsLegacy IGA platforms bolt on agent support; depth and automation vary significantly
\n\n\n\n

A few notes on the landscape:

\n

Identity providers are moving fast. Auth0's "Auth for MCP" became generally available on May 6, 2026, and Okta released its own MCP server as a secure protocol abstraction layer enabling AI agents to interact with Okta's scoped management APIs with least-privilege access control enforced at each tool call[2]. These are authentication solutions. They do not govern the full identity lifecycle.

\n

NHI specialists have the discovery story right. Veza's 2026 State of Identity and Access report found that a mere 0.01% of non-human identities control 80% of cloud resources, while the average worker holds 96,000 entitlements[16]. Knowing that is valuable. Governing it requires more than a posture dashboard.

\n

MCP gateways solve the runtime enforcement problem elegantly for agents you build inside their ecosystem. The problem is coverage: only 23.7% of organizations use their existing IAM/IdP as an authorization server for their agentic MCP infrastructure[3]. The rest are running disconnected auth stacks.

\n

IGA platforms are the natural home for agent governance - if they've actually built it. SailPoint expanded Agent Identity Security connectors in 2026 to include SaaS versions of Salesforce, ServiceNow, and Snowflake, but governance of agent identities requires a separate Agent Identity Security license[17]. Legacy IGA vendors are adding agent support as a module. That's not the same as designing for it from the start.

\n
\n

The Honest Gaps

\n

Standards are immature. The MCP OAuth 2.1 profile is solid for authentication but has no standardized audit trail format. MCP-I / KYA-OS is in active community development with sparse production implementations. The CSA ATF is a governance framework, not an enforcement tool.

\n

The monitoring gap is severe. Only 14.4% of organizations have achieved full IT and security approval for their entire agent fleet, and 88% of organizations reported confirmed or suspected AI agent security incidents in the past year[18]. Only 21.9% of organizations currently treat AI agents as independent, identity-bearing entities within their security model[3]. Most still treat agents as extensions of human users or generic service accounts.

\n

The over-permissioning problem is structural. 70% of security leaders say AI systems have more access than a human in the same role, and 67% of organizations rely on static credentials for AI systems[19]. Static, long-lived credentials are the opposite of what every framework recommends. They persist after an agent's task is complete, survive offboarding, and create the same orphaned-account problem that has plagued human identity governance for decades - just at machine speed.

\n

The CSA-Oasis State of NHI and AI Security 2026 found that 51% of organizations cite over-permissioned access as a top NHI pain point, and 78% have no documented policy for creating or removing AI identities[20].

\n
\"Isometric
\n\n\n\n
\n

What IGA Looks Like When It's Built for This

\n

The governance problem for AI agents is structurally identical to the governance problem for human identities - and for the same reason that IGA exists: access sprawl, orphaned accounts, over-permissioning, and the inability to answer "who has access to what, and should they?" at any given moment.

\n

The difference is velocity and scale. NHIs outnumber human identities 17 to 1 in the average enterprise, and the NHI population grew 44% year-over-year between 2024 and 2025[21]. AI agents are the fastest-growing segment within that already-exploding category. Quarterly access reviews cannot keep pace. Neither can spreadsheets.

\n

What's needed is a single governance plane that treats human and non-human identities with the same policy engine, the same lifecycle automation, and the same access review workflows - without requiring a separate module, a separate license, or a separate team.

\n

That's the design principle behind Iden. Rather than bolting agent governance onto a human-centric IGA platform, or treating agents as a subset of NHI discovery, Iden governs all identity types - employees, contractors, service accounts, bots, and AI agents - through the same policy-driven lifecycle engine. Fine-grained control at the channel, repository, and project level means an agent gets exactly the access its task requires, and that access is revoked when the task is done. No standing permissions. No orphaned agent accounts.

\n

For organizations evaluating where AI agent governance fits in their stack, the 12 Best IGA Vendors in 2026 post maps the full landscape, and our NHI explosion piece covers the scale of the underlying problem in detail.

\n
\n

How to Evaluate Agent Identity Capabilities Today

\n

The standards are immature, the vendor claims are ahead of the implementations, and the threat is real. Here is a practical evaluation framework for buyers.

\n
1
Inventory your agent estate before you buy anything

You cannot govern what you cannot see. Start with a full discovery pass: which agents are running, who deployed them, what credentials they hold, and what systems they can reach. Shadow agents — those with no registry entry, no assigned owner, and no managed identity — are your highest-risk population. Treat them as Critical findings.

2
Demand short-lived, scoped credentials — not API keys

Any platform that relies on shared API keys or long-lived static credentials for agent authentication is not a governance solution. Require per-session ephemeral tokens scoped to the specific task, with automatic teardown at end of session. This is the single highest-leverage control against prompt injection and credential theft.

3
Verify the AND gate, not the OR gate

An agent should only be able to do what the agent is authorized to do AND what the delegating user is authorized to do — not the union of both. Service accounts that inherit broad employee credentials create authorization bypass vulnerabilities. Confirm that your chosen platform enforces the intersection, not the superset.

4
Require a full audit trail at the tool-call level

Logging that an agent 'ran' is not an audit trail. You need: which agent, which user delegated, which tool was called, with what arguments, what data was accessed, and what the result was. The EU AI Act's transparency provisions take effect August 2, 2026. If your platform cannot produce this log on demand, it cannot support compliance.

5
Evaluate lifecycle governance, not just runtime enforcement

Runtime authorization at the tool-call level is necessary but not sufficient. You also need: agent registration and approval workflows before deployment, access reviews on the same cadence as human identities, and automated deprovisioning when an agent is retired. Ask vendors specifically how they handle agent offboarding — most have no answer.

6
Insist on unified governance across human and non-human identities

Separate tools for human IGA and agent governance create blind spots at the seams. An agent acting on behalf of a human should be governed in the same plane as that human — same policy engine, same access review, same audit log. If your IGA platform treats agents as a bolt-on module, you have a coverage gap.

\n\n\n\n
\n

The Bottom Line

\n

The 2026 standards landscape for AI agent identity is real and moving fast - MCP OAuth 2.1 under Linux Foundation governance, MCP-I / KYA-OS at the DIF, Microsoft Entra Agent ID in GA, and the CSA Agentic Trust Framework providing the governance vocabulary. These are genuine milestones.

\n

But standards are not implementations. Only 3% of organizations have automated, machine-speed controls governing AI behavior[19]. The gap between what the frameworks prescribe and what organizations have actually deployed is enormous.

\n

The organizations that close that gap fastest will be the ones that stop treating agent governance as a separate problem from identity governance. Agents are identities. They need the same lifecycle controls, the same access reviews, the same deprovisioning workflows, and the same audit trails as every other identity in your environment - just with shorter-lived credentials and faster policy enforcement.

\n

That's not a new category of tooling. It's IGA, built for the full population of identities your enterprise actually runs.

\n
\n\n\n
  1. microsoft.com — 80 of fortune 500 use active ai agents observability governance and security shape the new frontier
  2. marktechpost.com — Best authentication platforms for ai agents and mcp servers in 2026
  3. gravitee.io — State of ai agent security
  4. workos.com — Everything your team needs to know about mcp in 2026
  5. aaif.io — Mcp is now enterprise infrastructure everything that happened at mcp dev summit north america 2026
  6. prefect.io — Mcp oauth
  7. epinium.com — Model context protocol enterprise guide
  8. vouched.id — Vouched donates mcp i identity framework to the decentralized identity foundation to advance trust and security for ai agents
  9. blog.identity.foundation — Why dif said yes to mcp i
  10. learn.microsoft.com — What is microsoft entra agent id
  11. learn.microsoft.com — Agent identities
  12. microsoft.com — Secure agentic ai end to end
  13. cloudsecurityalliance.org — The agentic trust framework zero trust governance for ai agents
  14. oktsec.com — Csa agentic trust framework zero trust agents
  15. cloudsecurityalliance.org — Csa securing the agentic control plane
  16. veza.com — Forrester recognizes veza for iga ispm and nhi ai identity management
  17. aimultiple.com — Iga solutions
  18. gravitee.io — State of ai agent security 2026 report when adoption outpaces control
  19. cybersecstats.com — Ai cybersecurity statistics 2026 q1 q2
  20. secureflo.net — Ai agent identity management a 2026 ciso playbook
  21. labs.cloudsecurityalliance.org — Csa whitepaper nonhuman identity agentic ai governance v1 cs

Related reading

Segregation of duties

The Definitive Guide to Segregation of Duties (SoD): From Policy to Entitlement-Level Enforcement

A complete SoD guide: definition, toxic combinations, framework mapping (SOC 2, ISO 27001, SOX, PCI DSS), the conflict matrix, and why role-level SoD misses the real violations hiding inside broad entitlements.

Jul 24, 2026
Third-party access audit trail

Third-Party Access Is Your Audit's Weakest Link - Here's How to Fix It

Contractors and partners don't live in your HRIS - so they fall outside JML automation and become orphaned-access hotspots. Here's the evidence every auditor demands and how to produce it.

Jul 17, 2026
Legacy IGA migration

The Legacy IGA Migration Guide: Real Costs, Realistic Timelines, and a Step-by-Step Checklist

Replacing SailPoint IIQ, Oracle, IBM, or One Identity feels terrifying. This guide breaks down the real migration costs, honest timelines, and a step-by-step checklist to de-risk the switch.

Jul 13, 2026
","snapshot_chars":230483,"live_check":"changed"}]}