The most revealing detail in the entire agent identity gold rush of 2026 is not in any product announcement. It is in a spec document that was never submitted.
On August 24, Okta pushed ID-JAG into the wild alongside twenty-five partners. On October 15, Descope and ServiceNow launched within hours of each other. Between those two dates, five of the six vendors now claiming to ship agent identity products crossed the same threshold. And yet, three days before this stampede began, Microsoft had already been running Entra Agent ID in general availability since April — four months ahead of the pack, bundled into the E5 and E7 licenses that most large enterprises already pay for.
Microsoft did not implement ID-JAG. And nobody writing about this market has treated that absence as the story.
I have spent the last nine months building verification circuits for autonomous agents in a Sydney pilot, and the one lesson I keep returning to is this: the protocol that wins is rarely the protocol that is technically superior. It is the protocol whose sponsor already owns both ends of the connection. Microsoft owns both ends. Okta owns neither.
Following the ghost in the side-channel shadows
The IETF vote tells you everything if you stare at it long enough. 154 people supported forming a working group. 38 endorsed the proposed charter. That ratio — four to one in favor of doing something, nearly four to one against doing this specific thing — is the most reliable failure signal in standards work. I have watched OAuth 2.0 splinter into OIDC, watched SCIM grind forward on the strength of a single dominant use case, and I can tell you that the successful identity standards of the last two decades all shared one structural property: a single vendor with enough market power to force convergence on an unambiguous use case set.
Agent identity does not have that. A customer service agent, a coding agent, and a settlement agent in an institutional trading desk do not share trust requirements. They barely share a threat model. The customer service agent needs to read ticket data and nothing else. The coding agent needs repo write access, CI pipeline hooks, and usually a database credential someone forgot to rotate. The settlement agent needs to move real money and needs an audit trail that would satisfy a prudential regulator.
One charter cannot hold all three. Which means the correct frame is not "agents will get a standard." It is "agents will get four or five narrow profiles that do not interoperate, and the market will be won by whoever controls the identity provider that sits at the root of the most delegation chains."
That is Microsoft, probably. But it is worth understanding precisely why the technical fight does not matter as much as the narrative suggests.
Context: what ID-JAG actually does, stripped of the marketing
If you read only the vendor blogs, you would think ID-JAG is a new cryptographic primitive. It is not. It is a chain of three known mechanisms, glued together:
- JWT assertion issuance, per RFC 7523, published in 2015 and battle-tested inside every enterprise SSO deployment for a decade.
- Cross-authorization-server token exchange, per RFC 8693, published in 2020, the backbone of every workload identity system I have audited since.
- Scoped tokens, per the OAuth 2.1 scope semantics that have been with us since roughly forever.
What ID-JAG adds is not cryptography. It adds an architectural pattern: the user-to-application SSO hop is extended to a user-to-application-to-agent-to-resource chain, and the identity provider — not each individual resource server — becomes the issuer of the chain's root assertion. The grant form is a JWT carrying a user identity, an agent identity, and a scope restriction, signed by an IdP that the resource server has already been configured to trust.
This is valuable. It is disciplined engineering convergence, and it solves a real problem: without it, every resource server in the enterprise would have to independently validate agent assertions from every possible agent vendor, which is an O(n²) trust configuration problem that no operations team would survive. Centralizing the assertion at the IdP collapses that into O(n).
But it is a combination-level innovation, not an architecture-level one. And because it is combination-level, the technical differentiation between the six shipping vendors is far thinner than the market narrative claims.
Where liquidity narratives fracture and reform is in the three layers nobody is naming. The vendors talk about token format because token format is a press-release-able distinction — one is a JWT, another is opaque, another is protocol-agnostic. The actual competitive questions live underneath that:
The delegation semantics layer. How do you express, in a single unforgeable credential, the statement "agent B is acting on behalf of agent A, which is acting on behalf of user X, with scope limited to S, and the chain must be auditable end to end"? ID-JAG gives you a single hop. WIMSE gives you workload identity with SPIFFE-style identifiers. Neither gives you a compact, verifiable representation of a multi-hop delegation chain. Every enterprise deploying agents across more than one organizational boundary will hit this wall within twelve months, and none of the six products in market today have an answer.
The proof-of-possession layer. If an agent's bearer token is exfiltrated — via a config file leak, a CI log, a container image layer — does it stop working? For five of the six vendors, the answer is no. Descope is the only one that has built SPIFFE-bound mTLS into the agent credential path, which means the token is bound to a workload identity that cannot be replayed from a different process. The trade press treated this as a footnote. It is the single most important technical fact in the entire product set, because it directly addresses the failure mode that will define 2027's incident reports.
The revocation granularity layer. If agent A in a five-hop chain is compromised, can you revoke that one hop without breaking the other four? ServiceNow's tiered execution plus kill switch is the only product with a stated answer, and the granularity is coarse — it is a policy-level kill switch, not a per-hop revocation. But it exists. Five other vendors have nothing to say here.
These three layers are where the next eighteen months of competition will actually happen. The token format debate, which consumed most of the column inches, is decoration.
Core: the audit trail that nobody can read
Here is what two and a half years of building verification circuits taught me about autonomous systems, and what I think the entire agent identity market has mispriced.
I spent a substantial fraction of 2026 designing a framework where AI models prove competence through zero-knowledge proofs without revealing proprietary weights. The design worked. The proofs verified. And then we tried to write the audit log, and the whole architecture revealed its fragility in a way that has nothing to do with cryptography.
Picture the log entry. A resource is accessed. The access is attributed to an agent. The agent presents a credential. The credential is valid signature-wise, scope-wise, and issuer-wise. Everything checks out. The requesting system sees a perfectly legitimate transaction.
But what actually happened might be this: an agent with legitimate credentials was subjected to a prompt injection through a tool result, or through a poisoned document in a retrieval corpus, or through a malicious instruction embedded in a web page it fetched. The agent, still holding a valid token, still passing every authorization check, executed an action that its operator would never have authorized.
This is the problem I call the legal subject's illegal behavior, and no vendor has an answer. Cryptographically, the agent is who it says it is. Semantically, the agent is not doing what it was supposed to do. And your identity system, by construction, cannot distinguish between the two.
The industry's response so far has been to lean on behavioral detection — which is exactly what Cequence is selling, and which is exactly why Cequence is the most interesting and most commercially fragile company in the set. Its product is valuable precisely because it assumes agents lie. But that assumption, as true as it is, confines the company to detection-tool status. It will never become identity infrastructure, because its value proposition is built on the premise that identity infrastructure is insufficient.
Cequence is right. That is the uncomfortable part. The other five vendors, in claiming to solve agent identity, are solving about forty percent of the problem.
Now audit the fragility of synthetic stability more closely. What agent identity actually requires is not one standard but three interlocking ones:
- A credential format for the delegation chain. (ID-JAG and WIMSE are both partial answers.)
- A capability declaration language that expresses what an agent can do — not just a scope string, which is a flat namespace utterly inadequate for describing which tools an agent may invoke, which data classes it may touch, and which of those capabilities are transitive. A coding agent's "repo:write" scope tells you nothing about whether it is allowed to push to main or only to feature branches, whether it may modify CI configuration, whether it may add a deploy key.
- An integrity binding that ties the agent's actual code and model weights to its identity, such that a compromised agent runtime presents a credential that fails validation.
Only Descope has addressed (1) with any sophistication via PoP. Nobody has (2). The industry's current approach to (2) is a scope string, and a scope string is to a capability declaration what a file extension is to a file's actual contents — a hint that anyone with write access can falsify.
Nobody has (3), and reading the product launches, nobody appears to have noticed (3) exists.
Contrarian: the protocol-agnostic layer is harder than anyone admits
Let me interrogate the consensus of the crowd on the one claim that has gone completely unchallenged: that "protocol-agnostic governance" — Postman's gateway model, Cequence's traffic-mirroring model — is an elegant way to sidestep the standards war.
The framing is seductive. If ID-JAG and WIMSE and AIMS are all fragmented, then build a layer that accepts any token format and enforces policy uniformly. Then the standards war does not matter.
But accepting any token format is the easy half of the problem, and it is the half the vendors are solving. The hard half is normalizing the authorization semantics of MCP and A2A into a single policy model, because those two protocols were not designed to be semantically compatible.
MCP's authorization model is OAuth 2.1 with Resource Indicators and an enterprise-managed authorization extension. It is fundamentally about a client acquiring a token from a resource server's authorization server, with tight scope control. A2A's authorization model is expressed through the Agent Card's declared security schemes — primarily OIDC and OAuth2 — and it is fundamentally about agents advertising capabilities and the requester selecting an agent whose advertised scheme it can satisfy. The two protocols differ on subject identification (MCP identifies the client, A2A identifies the agent-as-a-service), on capability declaration (MCP uses scopes, A2A uses Agent Card fields), and on delegation chain expression (MCP has essentially no native concept of chained delegation; A2A has a partial one through the task context).
To unify these into a single policy model, you must write a semantic translation layer that maps MCP scopes to A2A Agent Card capabilities, maps MCP's client identity to A2A's service identity, and expresses both in a common delegation vocabulary. That layer is a substantial piece of engineering — a protocol compiler, essentially — and calling it "protocol-agnostic" is marketing shorthand for "we have decided the translation problem is beneath discussion."
My prediction: by mid-2027, at least one of these protocol-agnostic gateways will have shipped a perfectly functional product that enforces policy correctly for MCP and, on closer inspection, silently approximates A2A semantics in a way that permits a class of cross-protocol action the customer never intended to approve. That failure will be hard to detect, because the gateway will log successful policy evaluations for every request it incorrectly permits. Where liquidity narratives fracture and reform, audit trails look clean until they don't.
The absence that matters most: OpenID Foundation and the certification economy
The deepest structural omission in this entire market narrative is not Microsoft. It is the fact that nobody has mentioned the OpenID Foundation, Kantara Initiative, or the FIDO Alliance.
Here is how enterprise identity procurement actually works, and I know this because I have sat on the buyer side of three cycles. When a bank or a hospital or a government agency writes an identity solution into a procurement document, they do not write a request for a specification. They write a requirement for a certification: Kantara Initiative's identity assurance framework, FIDO Alliance certification for authenticators, FAPI conformance for open banking. The reason is simple: procurement officers cannot evaluate cryptography. They can evaluate certificates. A certificate is an attestation from a recognized authority that a vendor's implementation has been independently tested against a published profile. A specification is just a document.
This creates an inversion that the entire agent identity market has missed. The IETF's working group failure is not the binding constraint on enterprise adoption. The binding constraint is that there is no conformance test suite and no certification program for agent identity. Even if the IETF published RFC 97XX tomorrow, defining a perfect agent credential, no bank could procure it, because their vendor risk committee has no mechanism to evaluate whether a given implementation of RFC 97XX is correct.
OpenID Foundation's historical pattern is instructive. FAPI — the Financial-grade API profile — did not emerge from the IETF. It emerged from OIDF because the financial services sector needed a constrained, testable profile of OAuth 2.0 with mutual TLS, signed request objects, and strict issuer validation. FAPI succeeded not because its cryptography was novel but because OIDF built the conformance suite and the certification program alongside the spec. Enterprises could then say "must be FAPI certified" in a procurement document, and vendors could be evaluated.
Agent identity needs the same treatment. It needs a profile — one profile per use-case cluster, likely — with a conformance suite, with a certification program, with a procurement-friendly badge. Until that exists, the six vendors will compete on feature lists and partner counts, and enterprises will run pilots, and the pilots will not convert to production deployments, because nobody in procurement can sign off on an uncertified identity primitive.
And this is where ServiceNow's positioning becomes far more interesting than the market has recognized.
Tracing the vector of narrative contagion: who actually pays for agent identity
Which brings us to the question that every one of these announcements dodged: who is the paying party?
In traditional IAM, the paying party is unambiguous. An enterprise pays to manage the identities of its employees, and the budget line is IT security. Agent identity breaks this. There are three plausible payers, and their budgets, willingness to pay, and procurement processes do not overlap:
The agent's owner — typically enterprise IT — would buy through the IAM budget line, which means competing directly against Okta and Microsoft Entra. This is the most natural budget line for an identity product, and it is the most contested.
The agent's operator — typically a SaaS vendor running agents on behalf of customers — would buy through cloud infrastructure budget, which is hyper-optimized for cost. A SaaS vendor running ten million agent sessions per month views identity as a rounding error on compute, and will build rather than buy unless the buy price is negligible.
The resource owner — the party whose data is being accessed — would buy through the API security budget, which is Cequence's home turf, and which sits in the security operations organization, not identity.
These are three separate purchasing processes with three separate budget owners, and no single product can address all three with coherent value. A vendor that tries will end up with a product that is mediocre for all three. A vendor that focuses will be strong in one and absent from the other two.
Now apply this to the six vendors, because it reveals something the comparison tables miss.
Okta's position is structurally exposed. Its assets are real: twenty-five-plus launch partners including Anthropic, Zoom, Slack, and Cloudflare; a normative position in MCP's enterprise-managed authorization extension; original drafting authorship on ID-JAG. But its customers are also Microsoft's customers. Entra Agent ID reached GA in April 2026, four months before Okta's launch, and Entra's agent identity is bundled into E5 and E7 licenses that most large enterprises have already purchased. The marginal cost of adopting Entra agent identity, for a Microsoft-licensed enterprise, is effectively zero. The marginal cost of adopting Okta agent identity is a new SKU, a new contract, and a new integration. Okta's only coherent defense is cross-platform neutrality — the claim that agent identity must work across Microsoft, AWS, Google, and every SaaS in the estate, and only an independent vendor can deliver that. That claim is true and it is strategically correct and it is nearly impossible to quantify in a procurement negotiation against a zero-marginal-cost bundled alternative.
ServiceNow's position is the most underrated in the entire set, and the analysis has completely missed why. The narrative frames ServiceNow's AI Passport as the second camp — the AIMS/WIMSE-based alternative to ID-JAG. That is the surface read, and it is wrong.
ServiceNow's actual moat is not the protocol it selected. It is the fact that ServiceNow owns the CMDB — the Configuration Management Database — which is the authoritative inventory of enterprise IT assets and their dependency relationships. And here is what the market does not understand: the hard problem in agent identity is not issuing credentials. It is deciding what the agent should be permitted to access. That decision requires an authoritative, current, dependency-aware inventory of what exists, what depends on what, and what would break if access were granted. That inventory is the CMDB.
ServiceNow does not need to win the standards war, because it owns the input side of the policy decision. An enterprise can adopt any credential format it likes, and ServiceNow's AI Passport can still make a better authorization decision than any competitor, because it has better information about the environment. That is a durable advantage independent of protocol consolidation, and it is the only such advantage in the set.
This reframes the entire competitive picture. It is not two camps of standards. It is three: the standard-anchored camp (Okta, Descope), the protocol-agnostic camp (Postman, Cequence, and nominally ServiceNow), and the platform-native camp (Microsoft), plus ServiceNow as a fourth category entirely — the policy-input camp, which wins by owning the inventory rather than the credential.
Mapping the topology of hidden incentives: the absent acquirers
The single most important omission in the market comparison is not a shipping vendor. It is the absence of two entire categories of player that are most likely to buy these companies.
The first category is machine identity and privileged access management: CyberArk, now inside Palo Alto Networks; HashiCorp Vault; Venafi, now inside CyberArk. These companies have spent a decade selling machine identity to exactly the enterprises now deploying agents, they have the existing customer relationships, and they have the acquisition appetite and balance sheet. An agent is a machine identity with a language model attached. The technical adjacency is direct, and the customer base is the same.
Without naming these acquirers, the exit narrative for the six shipping vendors is incomplete. Descope, with the most complete product and the smallest distribution, is the most likely acquisition candidate. Cequence, with behavioral detection that is valuable precisely because identity is insufficient, is the second.
The second absent category is non-human identity security: Astrix, Oasis, Entro, and the cluster of 2024-2025 NHI startups. These companies have been discovering and governing machine identities since before the agent wave, and their discovery engines already map the credential sprawl that agent deployments will exacerbate. They are the natural consolidators.
Neither category appears in the current narrative, which means the narrative is being written by the vendors and the vendors have no interest in advertising their most likely buyers.
Auditing the fragility of synthetic stability: what breaks first
Let me pre-mortem this. Assume five of the six vendors ship successfully, integrations land, pilots convert. What breaks first?
The answer is not the standards fragmentation. It is the audit trail.
By Q3 2027, an enterprise with a mature agent deployment will have hundreds of thousands of active agent identities, each with a valid credential, each authorized against a scope string, each passing every authorization check. And when the first significant incident occurs — and it will — the post-mortem will discover that the agent that performed the unauthorized action was fully authenticated, fully authorized, and fully legitimate according to every identity system in the stack. The credential was valid. The scope was satisfied. The issuer was trusted. And the agent was hijacked through a retrieval corpus, or a tool response, or a malicious document.
The identity system will not have failed. It will have succeeded at exactly what it was designed to do, which was to establish that a particular workload was authorized to take certain actions. And the enterprise will discover that this was never the question it needed answered.
Which is why the behavioral layer — Cequence's positioning — is not a feature. It is a structural necessity. The most important product in the agent identity market is the one that says: the identity system is necessary and insufficient, and you must observe behavior.
That is also why Descope's SPIFFE and mTLS support is more important than it looks. Binding the credential to a workload identity means that a stolen bearer token, exfiltrated from a configuration file or an image layer, does not grant access. It is a partial answer to the hijacking problem — partial, because it does not help against a hijacked agent running in the correct workload — but it is the only technical answer any of the six vendors has shipped.
Takeaway: watch for the certification, not the RFC
Here is what I would watch over the next four quarters, and none of it is the IETF working group.
Watch for the first conformance test suite and certification program for agent identity, wherever it emerges — OpenID Foundation, Kantara, or a de facto industry consortium. That program will matter far more than any RFC, because that is what enterprises can actually procure. Watch for Microsoft to make Entra Agent ID's identity model the default for every agent deployed in Azure AI Foundry, which will make it the path of least resistance regardless of what the IETF decides. Watch for ServiceNow to convert CMDB-driven policy into an agent authorization standard, which would be the only standard emerging from a party that owns the input to the decision. Watch for the first major incident in which a hijacked agent exercises fully valid credentials, because that incident will reset the market's understanding of what agent identity actually solves.
Decoding the silence between the blocks: the six vendors that shipped are competing for a credential issuance layer that is already commoditized, while the two most valuable positions — policy input and behavioral verification — sit outside the competitive set entirely. And the standard, when it arrives, will arrive narrow, will arrive certified rather than specified, and will arrive four years after the products that already won the deployments.
The question is not which protocol wins. The question is whether your identity system can tell the difference between an agent doing what it was authorized to do, and an agent doing what its hijacker instructed. Today, it cannot. And every one of those six press releases is a claim otherwise.