Agent identity has an anchor inside every stack a firm already buys and none between them: Entra, Bedrock and Vertex all ship it, while an agent acting for a user across a trust boundary is governed by no ratified standard, no adopted working-group draft, no registry and no maintained implementation.

An earlier version of this page said nobody sells agent identity. That is now a year out of date and a CTO will spot it. The honest version is a split.

What this category solves (and what you did before it)

The problem is identity for delegation chains: who authorized this agent, acting on whose behalf, with what scope, for how long. Before it, and still wherever the chain crosses a company boundary, agents ride human-scoped credentials that were never designed to be delegated to software. See privilege and identity abuse.

What actually differentiates products

One distinction matters, and feature comparison misses it.

In-ecosystem, and shipping. Microsoft’s Entra Agent ID gives agents first-class identities with Conditional Access, lifecycle governance and anomaly flagging, licensed through Agent 365 (GA 1 May 2026) and M365 E7. AWS implements agent identities as workload identities in Bedrock AgentCore Identity, with inbound JWT authorizers, outbound credential providers and on-behalf-of access carrying audit trails. Google’s Vertex AI Agent Engine treats agent identity as a distinct IAM concept alongside service accounts, API keys and OAuth clients. These are documented, generally available, licensed products rather than roadmaps. (OWASP’s list adds Salesforce Agentforce and Workday’s Agentic System of Record; we could not reach a primary document for either, so treat those two as OWASP’s claim rather than ours.)

Cross-ecosystem, and absent. The missing piece is specifically delegation semantics. The closest IETF work, an OAuth identity-assertion authorization-grant draft, permits an actor token in token exchange and then explicitly defines no normative processing rules for it. The exact thing a delegation chain needs is the exact thing left undefined. The IETF’s workload-identity working group is active, but its charter makes no mention of AI agents and it has published no RFCs. The proposed Agent Name Service is an individual submission with no working-group adoption, expiring October 2026; its v2 (April 2026) changed direction substantially toward domain-anchored DNS and PKI with a transparency log, so cite v2 or don’t cite it. Of the decentralized-identity foundation, Verifiable Credentials 2.0 is a ratified W3C Recommendation while DIDs v1.1 is still a Candidate Recommendation soliciting experimental implementations: half the stack is a standard, half is not.

Two concrete tells. OWASP recommends signing every agent HTTP request with RFC 9421 (real, Standards Track, already used in production for bot verification) and publishing the key at /.well-known/agent-public-key.json, a path not registered with IANA. The only registered agent-related well-known suffix is agent-card.json, from the A2A specification. And the reference SDK for the DID-based agent-identity stack was created on 2 January 2025 and last pushed on 6 January 2025: four days of commits, no license, nothing since.

Tier

Day 2 for the in-ecosystem product: it arrives with the platform the firm already chose, and turning it on is configuration rather than procurement. Practice-only for anything cross-vendor. Don’t buy a cross-ecosystem agent-identity product in 2026; none exists, and the standard it would implement doesn’t exist yet.

The decision this page exists to make

Run centralized agent identity inside the stack the firm already owns. The strongest support for that comes from the leading decentralized proposal rather than from any vendor. Its own deployment matrix puts “highly regulated environments with a single auditing authority” squarely in the centralized column, alongside enterprise-internal multi-agent systems. Its listed advantages are simplified governance, unified control and audit, easier enterprise integration and clear accountability. Its listed disadvantages are a single point of failure, a scalability bottleneck, weak cross-organizational trust, and vendor lock-in.

That last one is the price, and it is better stated than discovered: buying in-ecosystem agent identity deepens the platform commitment the firm already made. For a 20–500-person fund that is the right trade. Just make it knowingly. See build vs buy.

The enterprise bar

SOC 2 Type II, ISO 27001, deployment mode, SSO and SCIM, RBAC, environment separation, exportable audit logs, zero retention, no-training terms, audit rights, viability and exit path. The hyperscaler offerings clear most of this by inheritance, which is much of their appeal. Two category-specific additions: can agent identity records and their delegation history be exported in a form another system could consume, and what is the revocation propagation time? See kill switches and revocation; revocation is an identity operation, not a process kill.

M&A state and category maturity

There is nothing to consolidate. The in-ecosystem products are hyperscaler features rather than acquisition targets, and the cross-ecosystem layer has no companies of consequence because it has no standard to build against. The usual advice (watch the standard, not the startups) holds with one correction: here the products are moving faster than the standards. The thing to watch is whether the OAuth actor-token semantics acquire normative processing rules.

The academic maturity signal is candid. The most-cited zero-trust agent-identity framework names its own unsolved problems in its own future-work section: ledger-based registration and revocation, and a session synchronizer that would have to track millions of active agent sessions, with no benchmarks and no measured deployments.

One frequently over-read passage, for accuracy: a well-known paper’s Let’s-Encrypt analogy for issuing agent IDs is specifically about users who run AI systems themselves with no deployer in the picture. It is not evidence that nobody has designed issuance.

Where the category is immature

Between stacks, entirely. If a firm’s agents only ever act inside one cloud tenant, this is solved enough to configure. The moment an agent authenticates to a counterparty, a fund administrator or a data vendor as itself, the firm is back to shared secrets and human-scoped credentials, and will be for a while.

See also

• Non-human identity — the two rival architectures this category would have to productize.
• Identity and access for agents — the control to implement today without waiting.
• Privilege and identity abuse — the confused-deputy failure driving the demand.
• Kill switches and revocation — revocation is an identity operation, not a process kill.
• Agent runtime security — the sibling category where the absence of a leader really does hold.
• Build vs buy — where the lock-in this page names gets priced.