Okta announced general availability of Agent SSO this week, folding AI agents into the identity infrastructure that already governs human employees. The move brings Okta's Cross App Access standard directly into its core identity platform, and the company says it's included in standard SSO plans at no extra charge — a signal that agent identity is being treated as table stakes, not a premium add-on. The framing matters more than the feature list. Okta's own research, cited in its announcement, found that only 34% of organizations apply the same security controls to AI agents that they apply to human workers. That gap is the actual story: enterprises have spent two decades building identity governance around people, and agents have been sneaking in through service accounts, shared API keys, and one-off OAuth grants that nobody inventories. Agent SSO is Okta's bet that the fix isn't a parallel system for machines but an extension of the one that already exists — same directory, same access reviews, same deprovisioning workflows, just applied to a new class of subject. That's a narrower claim than the decentralized-identity and DID-based proposals circulating in research papers right now. Okta isn't proposing a new trust model or a cryptographic credential format — it's extending Universal Directory, a centralized, vendor-run system, to cover agents. The company positions this as a first step: Agent SSO handles agents that already support Cross App Access, while a broader product, Okta for AI Agents, is meant to discover, onboard, and govern agents that don't fit that mold. The gap between those two tiers is worth watching, since most agents in production today aren't built with any standard delegation protocol in mind. The practical test will be adoption speed. Okta serves more than 20,000 customers, so if Agent SSO ships as a default rather than an opt-in, it could normalize "agent as directory entry" faster than any standards body could. It also sidesteps the harder unsolved problem — verifying what an agent actually did, not just who it claims to be — by keeping agents inside a centralized authority rather than a portable, cross-domain credential. That's a tradeoff enterprises may accept for speed, even if it leaves interoperability across identity providers unresolved.