Category 2 of 12 · Controls: On whose behalf the agent acts

Delegated and user-to-agent auth

Tools that let an agent act for a specific person with a narrower token that records both of them, including token exchange, Cross App Access, human approval steps, and token vaults.

Mitigates: ASI03 Identity and Privilege Abuse, ASI09 Human-Agent Trust Exploitation, LLM06 Excessive Agency

Vendors, by signal score

• #1
  Okta

  Workforce identity provider whose Okta for AI Agents registers agents in Universal Directory with human owners, and whose Agent SSO brings Cross App Access to agent connections.

  75
• #2
  Auth0

  Auth0 for AI Agents, part of Okta: user login for agents, Token Vault for third-party API tokens, asynchronous approval over CIBA, fine-grained authorization for RAG, and authorization for MCP servers.

  65
• #3
  1Password

  Credential manager whose Unified Access platform discovers AI tools and exposed secrets and lets agents use vaulted credentials, with an approval prompt in the 1Password desktop app for each autofill, without the secret reaching the model.

  60
• #4
  Descope

  Customer and agentic identity platform whose Agentic Identity Hub registers agents and MCP servers, stores third-party tokens in a vault, and supports Cross App Access (ID-JAG).

  59
• #5
  Arcade.dev

  Actions runtime for AI agents: handles OAuth and holds user tokens and secrets so agents can call tools on a user's behalf, with per-action authorization hooks and a catalog of MCP tools.

  54
• #6
  StytchAcquired by Twilio

  Developer identity platform whose Connected Apps turn an application into an OAuth and OIDC authorization server for AI agents and remote MCP servers, including Cross App Access. Acquired by Twilio in 2025.

  14

Ranked within this category only. How the score works.

Also covers this category

• Keycard

  Identity and access for AI agents: gives each agent its own identity and issues short-lived, per-request credentials scoped to the user and task, with policy checks and an audit log.

  44
• Microsoft

  Microsoft Entra Agent ID registers AI agents as directory identities with sponsors and lifecycle governance, and extends OAuth flows, Conditional Access, and sign-in logs to them.

  70
• Runlayer

  MCP gateway and agent platform: gives each agent its own account, issues on-behalf-of tokens that carry both the user and the agent, enforces per-tool policy, and exports every tool call to a SIEM.

  50

Questions to ask a vendor

1. Does it support RFC 8693 token exchange so downstream calls carry both user and agent?
2. Can a sensitive action pause for asynchronous human approval (CIBA)?
3. Are third-party tokens held in a vault that the model never sees?

Go deeper

• Token management for AI agents

FAQ

What does on-behalf-of mean for an AI agent?

The agent holds a token that says which person it is acting for and which agent it is, with scopes narrower than the person's own. Every system it calls can then log and limit the action correctly.

What is Cross App Access?

An extension that lets the enterprise identity provider approve an agent's connection from one app to another centrally, instead of each user clicking a consent screen. It is an official MCP authorization extension.