The State of AI Agent Identity 2026

Enterprises have managed non-human identities — service accounts, API keys, workload identities — for decades, mostly badly. Machine identities already outnumbered human ones by an order of magnitude before LLM agents arrived, and the OWASP Non-Human Identity Top 10 (2025 edition, still current as of this writing) reads as a catalog of the resulting failure modes: secret leakage, long-lived credentials, improper offboarding, over-privileged accounts.

AI agents inherit every one of those problems and add four that traditional NHI tooling was never designed for:

The result: agent identity crystallized as a distinct buying category somewhere between February and May 2025, when nearly every serious vendor shipped its first dedicated product within a twelve-week window — Stytch Connected Apps (Feb 20), Permit.io AI Access Control (Feb 25), Clerk's agent toolkit (Mar 7), Okta's Auth for GenAI preview (Apr 9), CyberArk Secure AI Agents (Apr 10), Descope's Agentic Identity Hub (Apr 22), and Microsoft Entra Agent ID (May 19).

The defining structural fact of 2026 is how fast the category's independents disappeared.

Three observations for buyers:

The acquirers came from three different directions. Platform-security consolidators (Palo Alto, Cisco, CrowdStrike) bought agent identity as a missing pillar. Identity incumbents (Okta, SailPoint, Delinea, Twilio, Ping via Keyless) bought speed. And — the most 2026 development — data and workflow platforms (ServiceNow, Snowflake, IBM, Cyera) bought it because agents touch their crown jewels and they'd rather own the control point than integrate someone else's. When Snowflake ships its own AI gateway with an identity-partner program, the platform layer is asserting that agent access control belongs to it.

Roadmap risk is now a real evaluation criterion. Four of the acquired products — Astrix's Agent Control Plane, Oasis AAM, Veza's AI Agent Security, StrongDM ID — were the category's most-cited independents a year ago. None disappeared, but all now serve an acquirer's platform strategy first. Buyers shortlisting in this category should weight the acquirer's integration record as heavily as the product; the Cloud Security Alliance published a research note on exactly this concentration risk after the Cisco–Astrix deal.

Independence is now a differentiator the remaining pure-plays actively sell. Aembit, Token Security, P0, Clutch, Corsha, Defakto, Keycard, and the newest entrants pitch neutrality — one identity layer across every cloud and platform — against suite lock-in. History (CASB, CSPM, ITDR) suggests a handful will stay independent long enough to matter; most will exit into platforms within two to three years.

We group the landscape into four segments by center of gravity. Many vendors straddle lines; we've placed each where its buyers actually meet it. Vendors with an IDSync directory profile are linked.

Acquired and absorbing — Astrix (→ Cisco), Oasis (→ Cyera, pending), Entro (→ SailPoint), Natoma (→ Snowflake): see the consolidation ledger above. Each remains the agent/NHI capability inside its acquirer.

Status and flagship agent capability per vendor, August 2026. "Sponsor binding" means the product formally links each agent to an accountable human owner. "Partial" means agent/MCP support exists but MCP-layer policy enforcement isn't the product's center. Dashes mean we found no formal capability as of the research date — corrections welcome via contact.

The protocol work matured faster than most 2025 predictions allowed. What's emerged is a three-layer stack, with real running code at every layer.

SPIFFE/SPIRE (CNCF-graduated) is the consensus answer for cryptographic workload identity — short-lived, attestation-based credentials instead of static secrets — and 2026's reference architectures from HashiCorp, Stacklok, Teleport, and Defakto all place it under agent deployments. Its known friction point for agents: SPIRE's pre-registration model fits long-lived services better than dynamically spawned sub-agents.

IETF WIMSE (Workload Identity in Multi-System Environments) is where the plumbing is being standardized: the architecture draft (March 2026), workload credentials, and proof-of-possession tokens are active working-group documents, and agent-specific drafts have started arriving. Notably, there is still no dedicated IETF working group for AI agents — agent identity work is distributed across WIMSE and the OAuth WG.

The MCP authorization spec is the most consequential standard in this report because it ships in every serious agent platform. It is OAuth 2.1 with MCP servers as resource servers, mandatory separation from the authorization server, and RFC 8707 resource indicators binding tokens to specific servers. Two revisions matter for anyone building now: the 2025-11-25 release added OIDC discovery, incremental scope consent, and Client ID Metadata Documents (CIMD) as the recommended client-registration mechanism; and 2026-07-28 — the largest protocol revision since launch — formally deprecated Dynamic Client Registration in favor of CIMD, required issuer validation, bound client credentials to the issuing authorization server, and made the protocol stateless.

If your agent-auth architecture was designed against the mid-2025 spec, the DCR-to-CIMD migration is now on your roadmap. Anthropic's Claude connectors already support CIMD alongside legacy dynamic registration — a preview of where every MCP host is heading. MCP itself now lives under the Linux Foundation's Agentic AI Foundation (donated December 2025), with adoption across Anthropic, OpenAI, Google DeepMind, and Microsoft.

The Identity Assertion Authorization Grant (ID-JAG) — productized as Cross-App Access (XAA) — is the enterprise answer to per-app OAuth consent sprawl: the corporate IdP exchanges an identity assertion for a scoped token to a downstream API, so agent access is brokered (and revocable) centrally. It reached draft -04 as an adopted OAuth WG document in May 2026, authored by Okta's Aaron Parecki with Ping's Brian Campbell; Okta runs an ecosystem program around it and Keycloak documents an implementation. This is the draft to watch for anyone selling into IT-governed agent deployments.

AuthZEN (OpenID Foundation) standardizes the PDP/PEP interface — the request/response shape for "may this agent do this?" — and its 2026 drafts are explicitly framed for the agent era, with interop demonstrated at Identiverse 2026. It's how the authorization vendors avoid becoming N incompatible policy silos.

Where we'd put probability mass between now and August 2027:

This report was compiled by IDSync in August 2026 from primary sources: vendor announcements and documentation, press releases, SEC filings (10-K/10-Q/8-K for acquisition terms), IETF datatracker records, official specification changelogs (MCP, A2A, SPIFFE), standards-body publications (OWASP, OpenID Foundation, W3C, NIST), and funding disclosures. Where only secondary reporting exists — for example, unconfirmed deal values — figures are marked "reported." Facts we could not verify against a primary source were excluded. Corrections: contact us — we fix and re-date.

IDSync is an independent, vendor-neutral buyer-research platform for identity, access, and authentication software, operated by TetraCore. No vendor paid for inclusion or placement in this report. Some vendors listed appear in IDSync's directory and comparison pages; sponsorships, where they exist, are disclosed on the relevant pages and had no bearing on this report's content.