Topic
Extending identity, short-lived credentials and audit logging to autonomous AI agents and MCP servers.
XDC Network has named Concordium the exclusive identity provider for XDC AI, letting agents show a passport-checked owner stands behind them. A buyer cannot yet assume every agent has one.
Reality
Descope's Agentic Identity Hub 3.0 provisions no employee-requested AI agent until a reviewer approves it. Descope says teams will not route around the workflow, but it did not disclose approval times.
Reality
Workday signed a definitive agreement to acquire C1.ai, an agentic identity platform, with closing expected in the quarter ending Jan. 31, 2027. With C1.ai, Workday says it will become the identity governance layer for people, money and agents.
Reality
KB Kookmin Card and SBI Holdings signed an MOU with two security firms to test AI-agent identity checks and study stablecoin spending by Japanese tourists. The agent tests come with a sequence and a product; the stablecoin side is a study list.
Reality
HKT Payment is testing, in a Hong Kong regulator's sandbox, a blockchain 'agentic ID' that ties an AI agent's payments to a verified person or company. The pilot brings the question of whom an agent acts for under supervisory review, though the report describes a test and no rule.
Reality
Amazon cut Meta's Muse off for arriving unannounced, browsing without identifying itself, and appearing to keep customer credentials. Signed-request verification, already running at Cloudflare and CloudFront, answers the middle objection.
Perspective Coverage
7 publishersReality
Cardano Foundation spun out Veridian with shares issued as Swiss DLT Act securities, the first asset on Cardano's CIP-0113 token standard. No price for the shares has been disclosed, and the first test of equity changing hands under the standard's transfer checks is the outside raise Veridian plans for 2027.
Perspective Coverage
4 publishersReality
OpenAI's ChatGPT Windows app contains a flow for claiming permanent email handles of up to 30 characters and fixed work addresses for dots, RuntimeWire found. As coded, each employee's dot would become its own mail identity for IT and security teams to inventory and govern.
Reality
FingerprintJS is adding four products that verify AI agents from five named platforms and flag automation that only claims to be one. Sites still have to write the rule for what a verified agent may do on each page.
Reality
Baselayer's fraud consortium works because the same businesses keep applying across the 2,000 institutions on its network, and an AI agent that spins up for one task and disappears shows up once.
Reality
The startup says its Agentic Identity Suite cryptographically links an agent's actions to the platform that deployed it and the company that approved it. It already sells business verification to one in five US banks.
Reality
A dev.to build reproduces the runaway spend Mandiant reported in September by pointing three agents at the same Convex route and changing only where the server looks for the running total. Each call costs $2.50.
Reality
Agent SSO went generally available on August 24 at no extra cost inside core Okta SSO, registering Cross App Access agents in Universal Directory and issuing short-lived tokens. Discovering unregistered agents takes a separate subscription.
Reality
Auth0's documentation gives middle-tier services and MCP servers an RFC 8693 route to call downstream APIs as the user. The token carries the delegation chain, and the exchange has its own rate ceiling.
Reality
A dev.to build runs two agents against one Convex API, one holding Kinde's default token and one rebuilding its token every two minutes. The client secret in the environment variable keeps the lifetime it always had.
Reality
Mastercard will issue one-time-use card credentials to AI agents that cardholders authorize in advance, in a partnership with the startup Alchemy. Its chief AI and data officer has said the fraud rules have to change first.
Reality
Mandatum signs each delegation link to its parent by hash and leaves the decision to an AuthZEN policy engine. The sequence check that blocks a write after an external read needs a single in-process enforcement point.
Reality
At Fal.Con 2026 CrowdStrike said each AI agent will get a cryptographically verifiable identity and short-lived brokered access in place of a borrowed human credential. Coverage is whatever discovery finds.
Reality
Uber built its internal agent platform in early 2025 and opened thousands of services to agent calls, then spent the rest of the year rebuilding identity because a pull request could not say which engineer asked for it.
Reality
A PingFederate write-up wires RFC 8693 token exchange to a SPIRE JWT-SVID so neither the user's token nor the workload's proof can stand in for the other. The lifetimes tell you where the risk sits.
Reality