IETF, Microsoft, Anthropic push standards for agent identity security

The push for agent identity standardization addresses two major authentication and authorization challenges as AI agents proliferate. First, agents must never receive, hold, or pass key material for onward authentication—any service acting as middleware for these credentials becomes a massive target. Microsoft's Entra Agent IDs enforce this by ensuring agents can only be delegates, never authenticators themselves. Second, authorization scopes need to be granular, time-bound, and adaptable, moving beyond current oversimplified OAuth consent flows that often grant broad, static permissions without context.

Multiple efforts are underway. Anthropic documents support for Workload Identity Federation from Google Cloud, yet notably omitted it from their recent zero-trust whitepaper—drawing sharp critique from identity expert Dick Hardt, who highlighted the gulf between AI developers and identity professionals. Hardt is developing the AAuth protocol, which shares goals with broader IETF streams addressing agent identity complexity. The IETF is actively working on protocols that build on OAuth 2.0 and OIDC foundations, recognizing that identity protocols are already too complex for many developers and agent needs will only increase that complexity.