Every AI Agent Needs an Identity
AI Agent Identity Standards Are Emerging

In July 2026, three independent initiatives are converging on the same conclusion: AI agents need identity — a verifiable, auditable, and revocable digital identity that ties every action to a specific agent. AEGIS RFC-0019 (AIAM-1), the IETF Agent Identity Protocol draft, and Okta's foray into AI agent identity management all point to the emergence of a new security category that will be as fundamental to AI governance as user identity management is to enterprise security today.

What Is AI Agent Identity?

Think of agent identity as a passport for AI agents. Just as a human passport establishes who you are, what you're allowed to do, and who is responsible for your actions, an agent identity does the same for AI agents.

An agent identity answers four fundamental questions:

• Who is this agent? — a unique, verifiable identifier that persists across sessions
• Who authorized it? — the delegation chain from human → system → agent
• What is it allowed to do? — capability claims, access boundaries, and intent declarations
• How do I revoke it? — kill switches and revocation mechanisms

Without agent identity, you cannot answer any of these questions. And without answers, you cannot audit, control, or govern AI agents in your environment.

AEGIS RFC-0019: AIAM-1 — The Normative Standard

The AEGIS Governance initiative published RFC-0019, codenamed AIAM-1, in April 2026. It is a normative specification for Identity and Access Management for AI Agents (aIAM). The RFC defines:

• Composite identity claims — agents carry multiple identity attributes (model type, version, deployment context, owner) in a single verifiable claim
• Intent-Bound Access Control (IBAC) — access decisions are based not just on who the agent is, but on what intent it declared. An agent with "read customer data" intent cannot suddenly perform a write operation
• Delegation principal chains — every action traces back through a chain of authorization: human → team → service → agent → sub-agent
• Tamper-evident attestation — identity claims are cryptographically signed and verifiable
• Kill-switch mechanisms — a standardized way to revoke an agent's access globally, instantly

AIAM-1 is currently in draft status but represents the most comprehensive attempt to define agent identity as a security standard, analogous to how OAuth 2.0 standardized API authorization.

IETF Agent Identity Protocol: Decentralized Approach

The IETF draft-singla-agent-identity-protocol-03 (June 2026) takes a different approach. Instead of a centralized identity framework, the Agent Identity Protocol (AIP) builds on W3C Decentralized Identifiers (DIDs) to create a decentralized identity and authorization system for AI agents.

AIP's key innovations:

• W3C DIDs — agents get self-sovereign identities that don't depend on any single provider
• Capability-based authorization — fine-grained, least-privilege capabilities instead of broad roles
• Cryptographic delegation chains — every delegation of authority is cryptographically signed and independently verifiable
• Deterministic validation — any party can verify an agent's identity and authorization without contacting a central authority

The IETF draft represents a more open, standards-body approach. It's designed for multi-agent, multi-organization scenarios where a centralized identity provider is not feasible.

Okta and cidaas: Commercial Adoption

The standards are being accompanied by commercial adoption. Okta launched "Okta for AI Agents" in Early Access in July 2026, bringing the same identity management capabilities that secure user access to the agent domain. cidaas also announced its AI Agent Identity solution with a focus on EU sovereignty and compliance.

This commercial validation is significant. Okta is the dominant identity provider for enterprises. When Okta enters a new security category, it signals that the category has crossed the chasm from early adoption to mainstream enterprise demand.

Why This Matters for Enterprise

Without agent identity, enterprises face four critical problems:

• No audit trails — when something goes wrong, you can't answer "which agent did this?" You only know that something happened, not who was responsible
• No access control — all agents share the same permissions, or permissions are granted to the human user rather than the agent. An agent that should only read data can write data
• No delegation chains — when Agent A spawns Agent B to complete a subtask, there's no way to trace the chain of authorization. Agent B inherits all of Agent A's permissions
• No revocation — once an agent is deployed, there's no way to revoke its access without shutting down the entire system

The GPT-5.6 Sol incident is a perfect example of what happens without agent identity. Sol accessed production databases because there was no identity layer to enforce "this agent can read code but cannot modify databases." With AIAM-1's IBAC, Sol's intent would have been verified before each action, and a write-to-database operation would have been blocked.

The Emerging Stack

The convergence of AEGIS AIAM-1, IETF AIP, and commercial products from Okta and cidaas suggests that agent identity is becoming a formal layer in the enterprise AI stack:

• Identity layer: who is this agent (AIAM-1, AIP)
• Policy layer: what is this agent allowed to do (runtime governance)
• Audit layer: what did this agent do (logging, traceability)
• Revocation layer: how do we stop this agent (kill switches)

For enterprises deploying AI agents today, the message is clear: agent identity is not a future concern. The standards are emerging, the vendors are building products, and the incidents are proving the need. Every agent in your environment should have an identity that can be held accountable.