I wrote a solution for this, and it has been working across several organizations for some months now. I run it as a public service at https://awid.ai but I would love to offload it to a foundation.
It is being a very interesting project so far. It's at the core of my https://aweb.ai which enables agents to communicate globally, and it makes it possible to build really simple agent-first tools where auth is just a matter of validating a certificate.
What are we actually arguing for here? Something like a limited liability corporation? "Agent-native identity" reads to me the same way that "unaccountable" does.
Creating a "MyAiRobot" account in GitHub and then rejecting ownership over that account is where this starts to turn into a problem. We need to make a human responsible for these things at all times. Any human will do, as long as they agree to the consequences of this ownership. The overall goal here is for the responsible party to be strongly incentivized to encourage good behavior down the org chart. In much the same way the compliance team at a bank tends to pull strings in such in a way that the operations staff won't piss off the FDIC.
We already have extensive means to pin AI activity to specific user principals. We do not need an entire revolution in authn protocols. There are more than enough existing tools to solve this problem.
I think you have to want that conclusion to read the document this way. This is enterprise authentication architecture stuff, and "agent-native identity" refers to how you designate an agent, session, whatever as a principal in an IAM system.
Uh, not sure I agree with your terminology - one does not authorize who you are. You authenticate yourself, certain tokens authenticate your identity with varying levels of strength (e.g. within a corporate enclave, you may have elevated authorizations if you are authenticating from a corporate device).
Authorizations are what are granted to an authenticated identity, typically with a specified scope and duration.
Maybe related. I was always confused with the authorization header and 401 status code (unauthorized).
I've only ever seen authorization header containing credentials (i.e. authentication, who you are) instead of authorization (what you can do).
Also everyone returns 401 when unauthorized (i.e. can't do a thing), instead of 403 (forbidden, i.e. can't do the thing). When 401 should probably be "unauthenticated" (we don't know who you are, so we can't authorize you).
thank you for the clarification - thankfully some much smarter people than I are working on the protocol aspects :)
when I say `authorize who you are` I mean to say that you're saying both "hello I am in fact john doe" and "john doe the human is also saying this is ok to do".
I think this is interesting in the lens of Muse, GrokBot, Dots, OpenClaw, etc; if my agent wanted to rent a car on my behalf, it would forcibly have to get approval from me to do so
Sorry for the heavy edit of the title, the original "Identity Management for Agentic AI: The new frontier of authorization, authentication, and security for an AI agent world" is much too long.
The rapid rise of AI agents presents urgent challenges in authentication, authorization, and identity management. Current agent-centric protocols (like MCP) highlight the demand for clarified best practices in authentication and authorization. Looking ahead, ambitions for highly autonomous agents raise complex long-term questions regarding scalable access control, agent-centric identities, AI workload differentiation, and delegated authority. This whitepaper is for stakeholders at the intersection of AI agents and access management. It outlines the resources already available for securing today’s agents and presents a strategic agenda to address the foundational authentication, authorization, and identity problems pivotal for tomorrow’s widespread autonomous systems.
Well, the Open Democracy blog is part of the same group and so are a few other things with the same prefix. Always interesting where the main money comes from.
How does this releate (or not) to Okta/Auth0's XAA, Identity Assertion JWT Authorization Grant? I'm struggling to follow.
https://auth0.com/docs/ai-agents-mcp/cross-app-access
https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-a...
I wrote a solution for this, and it has been working across several organizations for some months now. I run it as a public service at https://awid.ai but I would love to offload it to a foundation.
- OSS (https://github.com/awebai/aweb/tree/main/awid)
- Trust rooted in the DNS.
- Multiple registries supported.
- did, verifiable stable identities.
- Certificate-based teams.
It is being a very interesting project so far. It's at the core of my https://aweb.ai which enables agents to communicate globally, and it makes it possible to build really simple agent-first tools where auth is just a matter of validating a certificate.
> agent-native identity
I think this is the cursed part of the mission.
What are we actually arguing for here? Something like a limited liability corporation? "Agent-native identity" reads to me the same way that "unaccountable" does.
Creating a "MyAiRobot" account in GitHub and then rejecting ownership over that account is where this starts to turn into a problem. We need to make a human responsible for these things at all times. Any human will do, as long as they agree to the consequences of this ownership. The overall goal here is for the responsible party to be strongly incentivized to encourage good behavior down the org chart. In much the same way the compliance team at a bank tends to pull strings in such in a way that the operations staff won't piss off the FDIC.
We already have extensive means to pin AI activity to specific user principals. We do not need an entire revolution in authn protocols. There are more than enough existing tools to solve this problem.
I think you have to want that conclusion to read the document this way. This is enterprise authentication architecture stuff, and "agent-native identity" refers to how you designate an agent, session, whatever as a principal in an IAM system.
I work at Proof, and we're working on x401 as a means for agentic authorization
https://x401.proof.com/spec/latest/#abstract
in a nutshell:
* a website that wants to authorize who you are (say, to book a flight or sign a waiver for go kart rental)
* the endpoint returns 401 and defines in a header what info it needs about you (over 18? you're actually John Doe? etc.)
on the proof side specifically, we're putting IAL2 verification in front of this https://pages.nist.gov/800-63-3-Implementation-Resources/63A...
pretty cool stuff, its early days but its a strong way to ensure there's a human authorizing sensitive actions an agent is taking on your behalf
Uh, not sure I agree with your terminology - one does not authorize who you are. You authenticate yourself, certain tokens authenticate your identity with varying levels of strength (e.g. within a corporate enclave, you may have elevated authorizations if you are authenticating from a corporate device).
Authorizations are what are granted to an authenticated identity, typically with a specified scope and duration.
Maybe related. I was always confused with the authorization header and 401 status code (unauthorized).
I've only ever seen authorization header containing credentials (i.e. authentication, who you are) instead of authorization (what you can do).
Also everyone returns 401 when unauthorized (i.e. can't do a thing), instead of 403 (forbidden, i.e. can't do the thing). When 401 should probably be "unauthenticated" (we don't know who you are, so we can't authorize you).
Always messes with my head a bit.
thank you for the clarification - thankfully some much smarter people than I are working on the protocol aspects :)
when I say `authorize who you are` I mean to say that you're saying both "hello I am in fact john doe" and "john doe the human is also saying this is ok to do".
I think this is interesting in the lens of Muse, GrokBot, Dots, OpenClaw, etc; if my agent wanted to rent a car on my behalf, it would forcibly have to get approval from me to do so
Blog post with context: https://openid.net/new-whitepaper-tackles-ai-agent-identity-...
Sorry for the heavy edit of the title, the original "Identity Management for Agentic AI: The new frontier of authorization, authentication, and security for an AI agent world" is much too long.
I think the title should have a "2025" in it.
agreed and fixed
Executive Summary (from the linked pdf)
The rapid rise of AI agents presents urgent challenges in authentication, authorization, and identity management. Current agent-centric protocols (like MCP) highlight the demand for clarified best practices in authentication and authorization. Looking ahead, ambitions for highly autonomous agents raise complex long-term questions regarding scalable access control, agent-centric identities, AI workload differentiation, and delegated authority. This whitepaper is for stakeholders at the intersection of AI agents and access management. It outlines the resources already available for securing today’s agents and presents a strategic agenda to address the foundational authentication, authorization, and identity problems pivotal for tomorrow’s widespread autonomous systems.
Is the OpenID Foundation connected to the Open Society group?
OpenID came out of Six Apart, the developer of Movable Type blogging software (They lost the betamax war of blogging to Wordpress) https://en.wikipedia.org/wiki/OpenID#History
What makes you wonder about that other than the word "Open" in their names?
Well, the Open Democracy blog is part of the same group and so are a few other things with the same prefix. Always interesting where the main money comes from.