Key concepts

Three identities sit behind every agent request: the software (which agent), the person it acts for, and the operator (the company that runs it). They're easy to collapse into one record and expensive to separate later.

The vendors model the agent differently. Microsoft's Entra creates each agent identity from a blueprint (a template that holds credentials and mints tokens for many agents), adds an optional user account for systems that need a mailbox, and assigns a human sponsor who answers for it. Google ties each agent's SPIFFE ID to the resource that hosts it, so redeploying creates a new identity and old grants don't carry over. On the open web the identity is the operator's signing key, and the individual agent is invisible.

In the incidents, the identity that mattered was often the integration: Drift's Salesforce app, Klue's integration, Context.ai's Google OAuth client. Salesforce and Google contained those cases by blocking the app.

Nobody has a reliable count of agent identities: vendor ratios of machine identities to people range from 17 to 109 per person, which mostly shows their definitions differ.

An agent goes registered, given an owner, credentialed, active, restricted, disabled and deleted. The state most systems lack is orphaned, an agent whose owner has left, which is why Entra now moves sponsorship automatically. A web agent goes submitted to a gatekeeper's registry, accepted or rejected, verified, and sometimes delisted.

Timers define behaviour: Google's agent certificates last 24 hours, Visa accepts an agent's signature for 8 minutes, and NIST wants access tokens to last an hour or less.

Failures cluster in a few places. Tokens outlive their purpose: Klue's breach began with a credential made for an abandoned prototype and never switched off, and GitGuardian, which sells secret scanning, found 64% of the valid secrets it detected in 2022 still active four years later. Approvals decay into "always allow". And revocation is coarse, so whole integrations get switched off because nobody can pick out the bad tokens.

No one record says "Maya asked this agent to do this, here, with this approval". The pieces live apart:

The standard field for the agent is the act claim in token exchange, and the MCP spec doesn't mention it. Google and Entra each log the agent with its user or sponsor, in their own formats, and token passthrough makes downstream logs show the wrong caller. Gaps can go unannounced: Microsoft 365 Copilot didn't log which files it summarized until about August 2025, according to press reports.

NIST's concept paper asks how to bind each agent action back to a human's authorization. Until someone answers, I'd record for each action: agent ID, person ID, operator, token ID and audience, scope used, tool, a hash of the arguments, the outcome and any approval. For payments only, Google's AP2 mandates and Mastercard's Verifiable Intent come closest to a shared ledger.

The rules sit in four places:

• The company's identity provider: Entra ships Conditional Access templates for agents (block high-risk agents; separate rules for agents acting for someone and autonomous ones), Okta applies policy at the Cross App Access exchange, and Google uses org policies and IAM rules.
• The API or MCP server: OAuth scopes are plain strings and coarse. Rich Authorization Requests can describe a single action, and Auth0 uses them with CIBA, but I found no MCP proposal that does. MCP's tool annotations mark tools as read-only or destructive, as hints only, so the real check is the server's own permission rules.
• The agent's maker: Anthropic's browser agent has site permissions and asks before purchases, publishing or sharing personal data; OpenAI's agent asks before sending messages or payments; Supabase added read-only and project-scoped modes for its MCP server.
• The website: robots.txt, Cloudflare's Content Signals, and per-crawler Allow, Charge or Block rules.

No binding rule says how narrow an agent's scope must be or that agent and user must be told apart in logs. After an incident, the yardsticks will be NIST IR 8587, the MCP spec's "must" rules, CISA's joint guidance and OWASP's 2026 list for agentic applications, which ranks identity and privilege abuse third.

Dates I'd keep on a calendar as of October 2026:

When a vendor says "MCP support", ask which version: June 2025, November 2025 and July 2026 differ on how clients register, and dynamic registration can't be removed before July 2027 under the project's 12-month rule, by my reading.

The underlying standards are old enough to rely on. Everything specific to agents is a draft, and a handful of people at Okta, Ping Identity, AWS, Cloudflare, Google, OpenAI and a small workload-identity startup write most of them. Drafts move: ID-JAG must be renewed by November 22, 2026, and Web Bot Auth is months behind its own charter. An individual draft that would have added an agent field to OAuth requests expired without being adopted, so there's still no standard way to say who really did something.

Agent identity runs on several networks at once. Identity providers and the SaaS apps that trust them decide enterprise access, and Cross App Access moves the consent decision from each app to the provider. Content delivery networks verify agents at the edge for millions of sites. Card networks act as identity directories for agents that pay: Visa publishes keys for agents in its protocol, and Mastercard lets only registered agents transact. The FIDO Alliance started a working group on agentic authentication in April 2026, when Google donated its AP2 payments protocol and Mastercard contributed Verifiable Intent.

The counterparty that shows up most in loss chains is the integration vendor holding other companies' tokens: Salesloft's Drift, Klue, Context.ai. Each was a small tool with standing access to much bigger systems.

No law is written about agent identity. The layers that apply:

For a B2B product, the contract and the customer's security questionnaire bite before any law.

Revocation is the only remedy that works everywhere, and it comes in bulk: every Drift token, every Asana MCP connection after a June 2025 bug, Klue's whole integration. Undo is often possible but not obvious: when Replit's agent deleted a customer's production database in July 2025, it told the user rollback was impossible, and Replit's CEO later said a one-click restore existed. Payment reversals were designed for payments nobody authorized, which an agent's purchase may not be.

In every case I found, the money stayed where the contract put it, on the user. Vendors paid in engineering and reputation: Replit separated development and production databases, and GitHub said it would shorten token lifetimes for package publishing.