Agent Identity and Access

OAuth assumes a human who can click a consent screen. An autonomous agent cannot, and yet it needs scoped, revocable, auditable access to enterprise resources. The stack, built on Ory Kratos as the identity provider and integrated with the Model Context Protocol and existing enterprise platforms, answers that gap without weakening anything the organization already relies on.

What we built

• Standard flows for people: OAuth 2.0 and OpenID Connect, with SAML 2.0 and OIDC federation to enterprise identity providers such as Azure AD, Okta and Google Workspace, so users sign in with the credentials they already have.
• Delegation grants for agents. A person authenticates normally, then creates a delegation policy describing what an agent may do on their behalf. The agent receives a delegation token that encodes those permissions and requests access tokens within that scope autonomously. The delegation is time-bounded, scope-bounded and revocable in real time, a machine-readable power of attorney with strict limits.
• An agent identity protocol. Every agent receives a certificate signed by the organization's agent CA, encoding its type, version, owner and capability boundaries, whatever framework it was built with.
• A federation gateway that translates between JWT, SAML assertions, API keys and mTLS certificates when an agent from one framework calls a service with a different scheme.
• A policy engine that evaluates access requests against organizational rules with sub-millisecond decision latency.
• Token lifecycle management. Access tokens are short-lived JWTs, five minutes by default, with audience restrictions. Refresh tokens are bound to the requesting device or agent with DPoP, so a stolen refresh token is useless without the private key. Rotation is automatic. An HSM-backed signing service issues tokens with key rotation every 24 hours, and an introspection endpoint lets services catch revoked tokens within seconds.
• Anomaly detection on token usage. An agent that starts reaching outside its normal pattern has its delegation suspended automatically and the owner alerted.
• Audit logging of the full delegation chain, from the originating person through every agent in the path, the policies that authorized each hop, and the exact resource and operation accessed, with a correlation ID across the chain and an append-only, cryptographically chained log.
• Multi-tenancy with tenant-isolated identity stores and configurable federation policies for collaboration across organizations.

Design decisions

Delegate, do not impersonate. The simple approach, giving the agent the user's token, destroys accountability. A delegation grant keeps the person, the agent and the permissions as separate, inspectable objects, and lets the person watch and revoke what the agent does.

Identity for agents has to be framework-neutral. Certificates issued by the organization's own CA give every agent a verifiable identity regardless of how it was built, and the gateway handles the protocol differences at the edges.

Short tokens, bound tokens. Five-minute access tokens with audience restrictions limit what a leaked token can do; DPoP binding limits who can use a refresh token at all.

Make the audit log answer questions. Compliance teams ask things like "everything this agent accessed in the last 30 days and who authorized it" or "every access to financial data that went through a delegated agent". The log is structured so those are queries, not investigations, and it produces the evidence a security audit asks for.

In use

An analyst grants a research agent read access to one data domain for a week and sees every access it makes in a dashboard. A security engineer revokes a delegation and the agent's next request fails within seconds. An agent built on one framework calls a service that only speaks SAML, and the gateway translates. A reviewer traces an access from a sub-agent back to the person who started the chain.

Where it fits

Organizations that let autonomous agents touch real systems and have to answer who authorized what: enterprises adopting agents across teams, regulated environments, and any platform where agents from different frameworks share resources.

What we learned

The agent authentication problem is a delegation problem, not a login problem. Token lifetime and binding do more for security than any amount of monitoring. And an audit trail is only useful if it is shaped by the questions people will ask of it.

Technology

Ory Kratos as the identity provider. OAuth 2.0, OpenID Connect and SAML 2.0 federation with Azure AD, Okta and Google Workspace. Delegation grants. Certificate-based agent identities from an organizational agent CA. A federation gateway translating JWT, SAML assertions, API keys and mTLS. Short-lived, audience-restricted JWTs. DPoP-bound refresh tokens. HSM-backed signing with daily key rotation. Token introspection. An append-only, cryptographically chained audit log.