AI Agent Identity Management in 2026: Standards, Players, and the Governance Gap

MCP OAuth 2.1, MCP-I at the DIF, Microsoft Entra Agent ID - the 2026 standards landscape for AI agent identity is taking shape. Here's what's real, what's missing, and how to evaluate governance today.

10 min read · Last updated July 2026

The numbers are no longer theoretical. More than 80% of Fortune 500 companies now run active AI agents built with low-code and no-code tools^[1], and Gartner projects that up to 40% of enterprise applications will include integrated task-specific AI agents by the end of 2026, up from less than 5% today^[2]. Yet the security posture underneath that deployment wave is alarming: on average, only 47.1% of an organization's AI agents are actively monitored or secured^[3]. The other half operate without oversight, logging, or identity controls.

This is not a future problem. It is the current state of your production environment.

The good news - if you can call it that - is that the standards community has noticed. In the first half of 2026, more governance specifications landed for AI agent identity than in the entire prior history of the field. This post maps what those standards actually say, which vendor categories are responding, where the real gaps remain, and what a buyer should demand today.

The Standards Landscape: What's Actually Shipping

MCP OAuth 2.1 Under Linux Foundation Governance

The Model Context Protocol started as an Anthropic experiment in November 2024. By December 2025, Anthropic had donated MCP to the Agentic AI Foundation (AAIF) under the Linux Foundation, with OpenAI, Block, AWS, Google, Microsoft, Cloudflare, and Bloomberg joining as founding or platinum members^[4]. Within four months, the AAIF grew to 170 member organizations - more than double the membership CNCF had at the same stage of its life^[5].

The governance shift matters for enterprise buyers. MCP is no longer a single-vendor protocol that any one company can deprecate or fork. It is now closer in structure to CNCF than to a proprietary API.

On authentication specifically: the MCP spec mandates OAuth 2.1 with PKCE for all protected HTTP-based deployments, requiring HTTPS on all endpoints and discoverable authorization server metadata^[6]. The 2026 roadmap, published in March, makes enterprise readiness - including audit trails, SSO-integrated auth, and configuration portability - a top priority. The spec's authorization Working Group had six dedicated sessions at the April 2026 MCP Dev Summit, with the OAuth 2.1 spec author present.

The 2026 MCP roadmap flagged audit trail infrastructure, SSO-integrated auth, and configuration portability as the top enterprise requests^[7]. None of those are solved yet. The roadmap is a commitment, not a delivery.

The authentication gap is real. Research published in early 2026 documented more than 1,800 active MCP servers on the public internet with no authentication whatsoever. Because authentication in MCP is optional — not required by the spec — they are technically compliant and practically insecure. Before deploying any MCP server, verify OAuth 2.1 is enabled and enforced, not just installed.

\n\n\n\n

MCP-I / KYA-OS: Decentralized Identity for Agents

OAuth 2.1 handles authentication - proving an agent is who it claims to be. It does not answer the harder questions: Who authorized this agent? What is it allowed to do on behalf of which human? Can a downstream service verify that chain without prior coordination?

In March 2026, Vouched formally donated the Model Context Protocol - Identity (MCP-I) framework to the Decentralized Identity Foundation (DIF), where it is now stewarded by the DIF Trusted AI Agents Working Group^[8]. The spec has since been renamed KYA-OS (Know Your Agent Operating System) to reflect its scope beyond MCP alone.

MCP-I / KYA-OS uses Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) to enable cryptographically secure verification of both agents and their human principals - without requiring prior coordination between parties^[9]. The framework defines four identity questions every service should be able to answer: Who is the agent? Who authorized it? What is it allowed to do? What is the scope of that delegation?

This is the right architecture for multi-organization agent workflows - a travel booking agent acting on behalf of a user across airline, hotel, and payment systems, for example. It is also early. The spec is in active community development, and production implementations are sparse.

Microsoft Entra Agent ID

Microsoft moved fastest among the major identity platforms. Microsoft Entra Agent ID introduces agent identities as a distinct, purpose-built construct - not a repurposed service principal or user account - with agent identity blueprints serving as templates for creating individual agent identities with parent-child relationships^[10].

Agent identities in Entra do not have credentials of their own; they rely on the agent identity blueprint to acquire tokens on their behalf, and they only authenticate using federated identity credentials^[11]. This is the right model: credentials live in the blueprint, not on the agent, so a compromised agent cannot exfiltrate its own keys.

Microsoft Agent 365, generally available from May 1, 2026, gives each AI agent its own Entra Agent ID for identity, lifecycle, and access management, and integrates with Conditional Access, identity protection, and Microsoft Purview^[12]. Third-party agents from AWS Bedrock, n8n, and other frameworks can be onboarded via workload identity federation - no platform-specific credential management required.

The honest limitation: Entra Agent ID is a strong solution if your agent estate lives inside the Microsoft ecosystem. For organizations running heterogeneous stacks - Anthropic, AWS, open-source frameworks, and custom-built agents - the governance surface extends well beyond what any single IdP can cover.

CSA Agentic Trust Framework and CSAI Foundation

The Cloud Security Alliance has been the most prolific standards producer in this space. The CSA published the Agentic Trust Framework (ATF) on February 2, 2026 - the first governance specification applying Zero Trust principles to autonomous AI agents with a structured maturity model^[13]. The ATF was co-authored by John Kindervag, the original creator of Zero Trust.

A companion survey of 285 IT and security professionals makes the urgency concrete: 84% of organizations cannot pass a compliance audit focused on agent behavior or access controls, and only 23% have a formal agent identity strategy^[14].

The CSA's MAESTRO threat modeling framework explicitly names agent impersonation as a distinct threat class - malicious actors deceiving users or other agents by impersonating legitimate AI agents. The prescribed mitigations are trusted agent registries, cryptographic agent identities, and short-lived OAuth/OIDC tokens scoped to the intersection of what the agent is allowed to do AND what the delegating user is allowed to do. An AND gate, not an OR gate.

In March 2026, the CSA launched the CSAI Foundation at RSAC 2026, a new 501(c)3 dedicated exclusively to AI security, with a 2026 mission of "Securing the Agentic Control Plane" - governing identity, authorization, orchestration, runtime behavior, and trust assurance for autonomous AI agent ecosystems^[15].

The Player Map: Four Categories, Different Strengths

The vendor landscape has fragmented into four distinct categories. Understanding what each does - and doesn't do - is essential before buying.

AI Agent Identity: Vendor Category Comparison

Category	Examples	Core Strength	Key Gap
Identity Providers extending to agents	Microsoft Entra Agent ID, Okta (MCP server + Auth for MCP), Auth0	Standards-based auth (OAuth 2.1/OIDC), existing enterprise trust, lifecycle hooks	Ecosystem lock-in; heterogeneous agent stacks require federation workarounds
NHI Security Specialists	Oasis Security, Entro, Teleport	Discovery, secrets rotation, posture management for service accounts and API keys	Agent governance is identity-discovery-led, not runtime-enforcement-led; agents treated as NHI subset, not first-class
MCP Gateways	Arcade, TrueFoundry, Cloudflare Agents SDK	Runtime authorization at the tool-call level; per-session ephemeral credentials; low-latency enforcement	Closed ecosystems; governance doesn't extend to human identities or non-MCP agents
IGA Platforms governing agents + humans	Iden, SailPoint (Agent Identity Security add-on), ServiceNow/Veza	Unified lifecycle governance across human and non-human identities; policy-driven provisioning and deprovisioning; access reviews	Legacy IGA platforms bolt on agent support; depth and automation vary significantly

\n\n\n\n

A few notes on the landscape:

Identity providers are moving fast. Auth0's "Auth for MCP" became generally available on May 6, 2026, and Okta released its own MCP server as a secure protocol abstraction layer enabling AI agents to interact with Okta's scoped management APIs with least-privilege access control enforced at each tool call^[2]. These are authentication solutions. They do not govern the full identity lifecycle.

NHI specialists have the discovery story right. Veza's 2026 State of Identity and Access report found that a mere 0.01% of non-human identities control 80% of cloud resources, while the average worker holds 96,000 entitlements^[16]. Knowing that is valuable. Governing it requires more than a posture dashboard.

MCP gateways solve the runtime enforcement problem elegantly for agents you build inside their ecosystem. The problem is coverage: only 23.7% of organizations use their existing IAM/IdP as an authorization server for their agentic MCP infrastructure^[3]. The rest are running disconnected auth stacks.

IGA platforms are the natural home for agent governance - if they've actually built it. SailPoint expanded Agent Identity Security connectors in 2026 to include SaaS versions of Salesforce, ServiceNow, and Snowflake, but governance of agent identities requires a separate Agent Identity Security license^[17]. Legacy IGA vendors are adding agent support as a module. That's not the same as designing for it from the start.

The Honest Gaps

Standards are immature. The MCP OAuth 2.1 profile is solid for authentication but has no standardized audit trail format. MCP-I / KYA-OS is in active community development with sparse production implementations. The CSA ATF is a governance framework, not an enforcement tool.

The monitoring gap is severe. Only 14.4% of organizations have achieved full IT and security approval for their entire agent fleet, and 88% of organizations reported confirmed or suspected AI agent security incidents in the past year^[18]. Only 21.9% of organizations currently treat AI agents as independent, identity-bearing entities within their security model^[3]. Most still treat agents as extensions of human users or generic service accounts.

The over-permissioning problem is structural. 70% of security leaders say AI systems have more access than a human in the same role, and 67% of organizations rely on static credentials for AI systems^[19]. Static, long-lived credentials are the opposite of what every framework recommends. They persist after an agent's task is complete, survive offboarding, and create the same orphaned-account problem that has plagued human identity governance for decades - just at machine speed.

The CSA-Oasis State of NHI and AI Security 2026 found that 51% of organizations cite over-permissioned access as a top NHI pain point, and 78% have no documented policy for creating or removing AI identities^[20].

\n\n\n\n

What IGA Looks Like When It's Built for This

The governance problem for AI agents is structurally identical to the governance problem for human identities - and for the same reason that IGA exists: access sprawl, orphaned accounts, over-permissioning, and the inability to answer "who has access to what, and should they?" at any given moment.

The difference is velocity and scale. NHIs outnumber human identities 17 to 1 in the average enterprise, and the NHI population grew 44% year-over-year between 2024 and 2025^[21]. AI agents are the fastest-growing segment within that already-exploding category. Quarterly access reviews cannot keep pace. Neither can spreadsheets.

What's needed is a single governance plane that treats human and non-human identities with the same policy engine, the same lifecycle automation, and the same access review workflows - without requiring a separate module, a separate license, or a separate team.

That's the design principle behind Iden. Rather than bolting agent governance onto a human-centric IGA platform, or treating agents as a subset of NHI discovery, Iden governs all identity types - employees, contractors, service accounts, bots, and AI agents - through the same policy-driven lifecycle engine. Fine-grained control at the channel, repository, and project level means an agent gets exactly the access its task requires, and that access is revoked when the task is done. No standing permissions. No orphaned agent accounts.

For organizations evaluating where AI agent governance fits in their stack, the 12 Best IGA Vendors in 2026 post maps the full landscape, and our NHI explosion piece covers the scale of the underlying problem in detail.

How to Evaluate Agent Identity Capabilities Today

The standards are immature, the vendor claims are ahead of the implementations, and the threat is real. Here is a practical evaluation framework for buyers.

Inventory your agent estate before you buy anything

You cannot govern what you cannot see. Start with a full discovery pass: which agents are running, who deployed them, what credentials they hold, and what systems they can reach. Shadow agents — those with no registry entry, no assigned owner, and no managed identity — are your highest-risk population. Treat them as Critical findings.

Demand short-lived, scoped credentials — not API keys

Any platform that relies on shared API keys or long-lived static credentials for agent authentication is not a governance solution. Require per-session ephemeral tokens scoped to the specific task, with automatic teardown at end of session. This is the single highest-leverage control against prompt injection and credential theft.

Verify the AND gate, not the OR gate

An agent should only be able to do what the agent is authorized to do AND what the delegating user is authorized to do — not the union of both. Service accounts that inherit broad employee credentials create authorization bypass vulnerabilities. Confirm that your chosen platform enforces the intersection, not the superset.

Require a full audit trail at the tool-call level

Logging that an agent 'ran' is not an audit trail. You need: which agent, which user delegated, which tool was called, with what arguments, what data was accessed, and what the result was. The EU AI Act's transparency provisions take effect August 2, 2026. If your platform cannot produce this log on demand, it cannot support compliance.

Evaluate lifecycle governance, not just runtime enforcement

Runtime authorization at the tool-call level is necessary but not sufficient. You also need: agent registration and approval workflows before deployment, access reviews on the same cadence as human identities, and automated deprovisioning when an agent is retired. Ask vendors specifically how they handle agent offboarding — most have no answer.

Insist on unified governance across human and non-human identities

Separate tools for human IGA and agent governance create blind spots at the seams. An agent acting on behalf of a human should be governed in the same plane as that human — same policy engine, same access review, same audit log. If your IGA platform treats agents as a bolt-on module, you have a coverage gap.

\n\n\n\n

The Bottom Line

The 2026 standards landscape for AI agent identity is real and moving fast - MCP OAuth 2.1 under Linux Foundation governance, MCP-I / KYA-OS at the DIF, Microsoft Entra Agent ID in GA, and the CSA Agentic Trust Framework providing the governance vocabulary. These are genuine milestones.

But standards are not implementations. Only 3% of organizations have automated, machine-speed controls governing AI behavior^[19]. The gap between what the frameworks prescribe and what organizations have actually deployed is enormous.

The organizations that close that gap fastest will be the ones that stop treating agent governance as a separate problem from identity governance. Agents are identities. They need the same lifecycle controls, the same access reviews, the same deprovisioning workflows, and the same audit trails as every other identity in your environment - just with shorter-lived credentials and faster policy enforcement.

That's not a new category of tooling. It's IGA, built for the full population of identities your enterprise actually runs.

\n\n\n

AI Agent Identity Management in 2026: Standards, Players, and the Governance Gap

The Standards Landscape: What's Actually Shipping

MCP OAuth 2.1 Under Linux Foundation Governance

MCP-I / KYA-OS: Decentralized Identity for Agents

Microsoft Entra Agent ID

CSA Agentic Trust Framework and CSAI Foundation

The Player Map: Four Categories, Different Strengths

The Honest Gaps

What IGA Looks Like When It's Built for This

How to Evaluate Agent Identity Capabilities Today

The Bottom Line

Related reading

The Definitive Guide to Segregation of Duties (SoD): From Policy to Entitlement-Level Enforcement

Third-Party Access Is Your Audit's Weakest Link - Here's How to Fix It

The Legacy IGA Migration Guide: Real Costs, Realistic Timelines, and a Step-by-Step Checklist