Home Blog Agents
Agents

Agent Field Notes: identity for agents is the new feature race

Three vendors announced agent identity and control products in the last few weeks. Here is what each one says, where the gaps are and a small-team version you can do now.

By The Cadrix team5 min read
A black access-card reader mounted on a concrete wall beside a door
Photo by Jakub Żerdzicki on Unsplash

The second field note covers a single theme that dominated the autumn announcements: giving each AI agent its own identity, and controlling what that identity can do. The sources are vendor press material and one analyst recap. We say which is which.

RSA Agent ID, announced 29 September#

RSA announced Agent ID on 29 September 2026, aimed at regulated industries. According to coverage of the announcement, it has three parts: Discover finds agents and MCP servers across identity, cloud, endpoint and gateway systems, Secure enforces policy at an AI or MCP gateway, and Govern handles lifecycle and access reviews. Press coverage says Discover and Secure are due to be generally available on 16 November 2026 and Govern in the first half of 2027.

That schedule is worth noticing. The part that finds agents ships first. The part that governs their lifecycle ships last. We could not open the original press release ourselves, so the dates are as reported by secondary outlets.

Okta at Oktane, reported by Forrester on 1 October#

Forrester's recap of Oktane 2026, published on 1 October, describes Okta positioning its platform as a control plane for human, non-human and agent identities. It mentions a multi-vendor "Blueprint Alliance" and specifications for cross-application access developed with Anthropic and others as MCP authorisation extensions, which Forrester notes are not yet standards from a standards body.

The title of the recap is the interesting part: the details of agent governance and identity "remain unclear". Forrester points to gaps, including that agent pricing is unresolved and that universal "know your agent" standards have not been disclosed.

IBM, 27 October#

IBM announced Agent Identity at its TechXchange event on 27 October 2026, generally available alongside HashiCorp Vault 2.2. IBM's description is that it creates a verified record for each agent showing its owner, lifecycle status and granted authority, and shares that with Vault's credential controls to enforce least-privilege access and revoke access when an agent attempts something unauthorised. IBM's release also lists several other items as public or technical preview, so the availability differs by component.

A caution about reading launch announcements#

Launch material is written to make a category look finished. Two habits help when you read it. First, separate "generally available" from "preview" and "planned", as IBM's own release does and as RSA's staggered dates show. Second, look for the verb. "Discovers", "monitors" and "reports" are about visibility. "Blocks", "revokes" and "requires approval" are about control. Visibility is useful, and it is the first half. A dashboard that tells you an agent sent the wrong email an hour ago is not the same as a step that stopped it.

What these have in common#

All three treat an agent as something that needs the same basics as an employee account: a unique identity, a named owner, narrow permissions that can be revoked, and a trail. None of that is exotic. The novelty is that agents act at machine speed, across tools, on behalf of someone, so the gap between "can" and "should" matters more.

Notice also what is not in the announcements. Human approval for individual actions barely features. RSA's own approval controls are described as coming in future releases. Identity answers "who is this agent and what may it reach". It does not answer "should this particular refund go out today". Those are different controls, and you need both.

The small-team version#

You probably do not need an enterprise identity platform to get most of the benefit. Four habits cover a lot:

  1. One connection per purpose. Do not let every workflow share the same mailbox or the same API key. When something goes wrong you want to revoke one thing.
  2. Least privilege on tools. Give each workflow only the tools it uses. An agent that drafts replies does not need a tool that deletes records.
  3. Scoped keys for callers. If another system triggers your workflows over an API, give it a key with only the permissions it needs.
  4. A quarterly access review. Read the list of connections, keys and members. Remove what is unused.

In Cadrix, connections are stored encrypted and not shown to builders or the model, API keys carry only the permissions you give them, and roles are enforced on the server. That covers the first three. The review is still a human job with a calendar reminder.

Where the human goes. Put the person in at two points: the access review (who may use which connection) and the approval step before any action that spends, sends or deletes. Identity limits what an agent can reach. Approval decides whether this one use of that reach is a good idea.

One exercise for this week#

Pick your three most powerful workflows, meaning the ones that can send, change or spend. For each, write on one line: what identity does it run as, who owns it, what is the narrowest permission set that would still let it do its job, and who would notice if it did something unexpected. If you cannot fill in a line in under two minutes, that is your first finding.

What to ask a vendor, including us#

  • Can I see, per agent, who owns it and what it can access?
  • Can access be revoked immediately, and does it stop a run in progress?
  • Is there a record of what the agent did that I can export?
  • What is generally available today, and what is on a roadmap?

That last question is the one the autumn announcements make most necessary. Several of these products are partly in preview. A roadmap item is not a control.

Sources#

Get new posts by email

Practical notes on governed AI workflows, in your inbox. Unsubscribe whenever you like.

Opens your email app to send the request. We use your address only to send the blog. See the privacy policy.

Keep reading