AI Agent Identity Management in 2026: Standards, Players, and the Governance Gap

The numbers are no longer theoretical. More than 80% of Fortune 500 companies now run active AI agents built with low-code and no-code tools^[1], and Gartner projects that up to 40% of enterprise applications will include integrated task-specific AI agents by the end of 2026, up from less than 5% today^[2]. Yet the security posture underneath that deployment wave is alarming: on average, only 47.1% of an organization's AI agents are actively monitored or secured^[3]. The other half operate without oversight, logging, or identity controls.

This is not a future problem. It is the current state of your production environment.

The good news - if you can call it that - is that the standards community has noticed. In the first half of 2026, more governance specifications landed for AI agent identity than in the entire prior history of the field. This post maps what those standards actually say, which vendor categories are responding, where the real gaps remain, and what a buyer should demand today.

---

The Standards Landscape: What's Actually Shipping

MCP OAuth 2.1 Under Linux Foundation Governance

The Model Context Protocol started as an Anthropic experiment in November 2024. By December 2025, Anthropic had donated MCP to the Agentic AI Foundation (AAIF) under the Linux Foundation, with OpenAI, Block, AWS, Google, Microsoft, Cloudflare, and Bloomberg joining as founding or platinum members^[4]. Within four months, the AAIF grew to 170 member organizations - more than double the membership CNCF had at the same stage of its life^[5].

The governance shift matters for enterprise buyers. MCP is no longer a single-vendor protocol that any one company can deprecate or fork. It is now closer in structure to CNCF than to a proprietary API.

On authentication specifically: the MCP spec mandates OAuth 2.1 with PKCE for all protected HTTP-based deployments, requiring HTTPS on all endpoints and discoverable authorization server metadata^[6]. The 2026 roadmap, published in March, makes enterprise readiness - including audit trails, SSO-integrated auth, and configuration portability - a top priority. The spec's authorization Working Group had six dedicated sessions at the April 2026 MCP Dev Summit, with the OAuth 2.1 spec author present.

The 2026 MCP roadmap flagged audit trail infrastructure, SSO-integrated auth, and configuration portability as the top enterprise requests^[7]. None of those are solved yet. The roadmap is a commitment, not a delivery.

MCP-I / KYA-OS: Decentralized Identity for Agents

OAuth 2.1 handles authentication - proving an agent is who it claims to be. It does not answer the harder questions: Who authorized this agent? What is it allowed to do on behalf of which human? Can a downstream service verify that chain without prior coordination?

In March 2026, Vouched formally donated the Model Context Protocol - Identity (MCP-I) framework to the Decentralized Identity Foundation (DIF), where it is now stewarded by the DIF Trusted AI Agents Working Group^[8]. The spec has since been renamed KYA-OS (Know Your Agent Operating System) to reflect its scope beyond MCP alone.

MCP-I / KYA-OS uses Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) to enable cryptographically secure verification of both agents and their human principals - without requiring prior coordination between parties^[9]. The framework defines four identity questions every service should be able to answer: Who is the agent? Who authorized it? What is it allowed to do? What is the scope of that delegation?

This is the right architecture for multi-organization agent workflows - a travel booking agent acting on behalf of a user across airline, hotel, and payment systems, for example. It is also early. The spec is in active community development, and production implementations are sparse.

Microsoft Entra Agent ID

Microsoft moved fastest among the major identity platforms. Microsoft Entra Agent ID introduces agent identities as a distinct, purpose-built construct - not a repurposed service principal or user account - with agent identity blueprints serving as templates for creating individual agent identities with parent-child relationships^[10].

Agent identities in Entra do not have credentials of their own; they rely on the agent identity blueprint to acquire tokens on their behalf, and they only authenticate using federated identity credentials^[11]. This is the right model: credentials live in the blueprint, not on the agent, so a compromised agent cannot exfiltrate its own keys.

Microsoft Agent 365, generally available from May 1, 2026, gives each AI agent its own Entra Agent ID for identity, lifecycle, and access management, and integrates with Conditional Access, identity protection, and Microsoft Purview^[12]. Third-party agents from AWS Bedrock, n8n, and other frameworks can be onboarded via workload identity federation - no platform-specific credential management required.

The honest limitation: Entra Agent ID is a strong solution if your agent estate lives inside the Microsoft ecosystem. For organizations running heterogeneous stacks - Anthropic, AWS, open-source frameworks, and custom-built agents - the governance surface extends well beyond what any single IdP can cover.

CSA Agentic Trust Framework and CSAI Foundation

The Cloud Security Alliance has been the most prolific standards producer in this space. The CSA published the Agentic Trust Framework (ATF) on February 2, 2026 - the first governance specification applying Zero Trust principles to autonomous AI agents with a structured maturity model^[13]. The ATF was co-authored by John Kindervag, the original creator of Zero Trust.

A companion survey of 285 IT and security professionals makes the urgency concrete: 84% of organizations cannot pass a compliance audit focused on agent behavior or access controls, and only 23% have a formal agent identity strategy^[14].

The CSA's MAESTRO threat modeling framework explicitly names agent impersonation as a distinct threat class - malicious actors deceiving users or other agents by impersonating legitimate AI agents. The prescribed mitigations are trusted agent registries, cryptographic agent identities, and short-lived OAuth/OIDC tokens scoped to the intersection of what the agent is allowed to do AND what the delegating user is allowed to do. An AND gate, not an OR gate.

In March 2026, the CSA launched the CSAI Foundation at RSAC 2026, a new 501(c)3 dedicated exclusively to AI security, with a 2026 mission of "Securing the Agentic Control Plane" - governing identity, authorization, orchestration, runtime behavior, and trust assurance for autonomous AI agent ecosystems^[15].

---

The Player Map: Four Categories, Different Strengths

The vendor landscape has fragmented into four distinct categories. Understanding what each does - and doesn't do - is essential before buying.

A few notes on the landscape:

Identity providers are moving fast. Auth0's "Auth for MCP" became generally available on May 6, 2026, and Okta released its own MCP server as a secure protocol abstraction layer enabling AI agents to interact with Okta's scoped management APIs with least-privilege access control enforced at each tool call^[2]. These are authentication solutions. They do not govern the full identity lifecycle.

NHI specialists have the discovery story right. Veza's 2026 State of Identity and Access report found that a mere 0.01% of non-human identities control 80% of cloud resources, while the average worker holds 96,000 entitlements^[16]. Knowing that is valuable. Governing it requires more than a posture dashboard.

MCP gateways solve the runtime enforcement problem elegantly for agents you build inside their ecosystem. The problem is coverage: only 23.7% of organizations use their existing IAM/IdP as an authorization server for their agentic MCP infrastructure^[3]. The rest are running disconnected auth stacks.

IGA platforms are the natural home for agent governance - if they've actually built it. SailPoint expanded Agent Identity Security connectors in 2026 to include SaaS versions of Salesforce, ServiceNow, and Snowflake, but governance of agent identities requires a separate Agent Identity Security license^[17]. Legacy IGA vendors are adding agent support as a module. That's not the same as designing for it from the start.

---

The Honest Gaps

Standards are immature. The MCP OAuth 2.1 profile is solid for authentication but has no standardized audit trail format. MCP-I / KYA-OS is in active community development with sparse production implementations. The CSA ATF is a governance framework, not an enforcement tool.

The monitoring gap is severe. Only 14.4% of organizations have achieved full IT and security approval for their entire agent fleet, and 88% of organizations reported confirmed or suspected AI agent security incidents in the past year^[18]. Only 21.9% of organizations currently treat AI agents as independent, identity-bearing entities within their security model^[3]. Most still treat agents as extensions of human users or generic service accounts.

The over-permissioning problem is structural. 70% of security leaders say AI systems have more access than a human in the same role, and 67% of organizations rely on static credentials for AI systems^[19]. Static, long-lived credentials are the opposite of what every framework recommends. They persist after an agent's task is complete, survive offboarding, and create the same orphaned-account problem that has plagued human identity governance for decades - just at machine speed.

The CSA-Oasis State of NHI and AI Security 2026 found that 51% of organizations cite over-permissioned access as a top NHI pain point, and 78% have no documented policy for creating or removing AI identities^[20].

---

What IGA Looks Like When It's Built for This

The governance problem for AI agents is structurally identical to the governance problem for human identities - and for the same reason that IGA exists: access sprawl, orphaned accounts, over-permissioning, and the inability to answer "who has access to what, and should they?" at any given moment.

The difference is velocity and scale. NHIs outnumber human identities 17 to 1 in the average enterprise, and the NHI population grew 44% year-over-year between 2024 and 2025^[21]. AI agents are the fastest-growing segment within that already-exploding category. Quarterly access reviews cannot keep pace. Neither can spreadsheets.

What's needed is a single governance plane that treats human and non-human identities with the same policy engine, the same lifecycle automation, and the same access review workflows - without requiring a separate module, a separate license, or a separate team.

That's the design principle behind Iden. Rather than bolting agent governance onto a human-centric IGA platform, or treating agents as a subset of NHI discovery, Iden governs all identity types - employees, contractors, service accounts, bots, and AI agents - through the same policy-driven lifecycle engine. Fine-grained control at the channel, repository, and project level means an agent gets exactly the access its task requires, and that access is revoked when the task is done. No standing permissions. No orphaned agent accounts.

For organizations evaluating where AI agent governance fits in their stack, the 12 Best IGA Vendors in 2026 post maps the full landscape, and our NHI explosion piece covers the scale of the underlying problem in detail.

---

How to Evaluate Agent Identity Capabilities Today

The standards are immature, the vendor claims are ahead of the implementations, and the threat is real. Here is a practical evaluation framework for buyers.

---

The Bottom Line

The 2026 standards landscape for AI agent identity is real and moving fast - MCP OAuth 2.1 under Linux Foundation governance, MCP-I / KYA-OS at the DIF, Microsoft Entra Agent ID in GA, and the CSA Agentic Trust Framework providing the governance vocabulary. These are genuine milestones.

But standards are not implementations. Only 3% of organizations have automated, machine-speed controls governing AI behavior^[19]. The gap between what the frameworks prescribe and what organizations have actually deployed is enormous.

The organizations that close that gap fastest will be the ones that stop treating agent governance as a separate problem from identity governance. Agents are identities. They need the same lifecycle controls, the same access reviews, the same deprovisioning workflows, and the same audit trails as every other identity in your environment - just with shorter-lived credentials and faster policy enforcement.

That's not a new category of tooling. It's IGA, built for the full population of identities your enterprise actually runs.