Identity primitives for AI agents
The controls a CISO asks about first, against the vendors in the identity spine and MCP gateways. A claim links to the vendor's own documentation. "No public claim found" means the docs were read and did not say so; "Not checked" means nobody has looked yet.
Agent as a first-class identity
The agent is registered in the directory with its own identity, owner, and lifecycle, instead of borrowing a service account or a person's session.
Reference: Microsoft Entra Agent ID, Okta Agent SSO
| 1Password | Not checked |
| Acuvity | Not checked |
| Aembit | No public claim found |
| Arcade.dev | Not checked |
| Astrix Security | Claimed |
| Aurascape | No public claim found |
| Auth0 | Not checked |
| Cisco | No public claim found |
| CrowdStrike | No public claim found |
| Descope | No public claim found |
| Entro Security | No public claim found |
| Harmonic Security | Not checked |
| Keycard | No public claim found |
| Lasso Security | Not checked |
| Microsoft | Claimed |
| Natoma | Not checked |
| Nightfall AI | Not checked |
| Noma Security | No public claim found |
| Oasis Security | Claimed |
| Okta | Claimed |
| Operant AI | No public claim found |
| Palo Alto Networks | No public claim found |
| Permiso Security | Not checked |
| Portkey | No public claim found |
| Runlayer | Claimed |
| SailPoint | Claimed |
| SGNL | Not checked |
| Stytch | Not checked |
| Teleport | Not checked |
| Token Security | Claimed |
| Veza | No public claim found |
| Zscaler | No public claim found |
On-behalf-of token exchange
The agent trades a user's token for a narrower token that records both the user and the agent, so every downstream call carries the delegation chain.
Reference: RFC 8693
| 1Password | Not checked |
| Acuvity | Not checked |
| Aembit | Claimed |
| Arcade.dev | Not checked |
| Astrix Security | Not checked |
| Aurascape | Not checked |
| Auth0 | Claimed |
| Cisco | Not checked |
| CrowdStrike | Not checked |
| Descope | Claimed |
| Entro Security | Not checked |
| Harmonic Security | Not checked |
| Keycard | Claimed |
| Lasso Security | Not checked |
| Microsoft | Claimed |
| Natoma | Not checked |
| Nightfall AI | Not checked |
| Noma Security | Not checked |
| Oasis Security | Not checked |
| Okta | Not checked |
| Operant AI | Not checked |
| Palo Alto Networks | Not checked |
| Permiso Security | Not checked |
| Portkey | Not checked |
| Runlayer | Claimed |
| SailPoint | Not checked |
| SGNL | Not checked |
| Stytch | Not checked |
| Teleport | Claimed |
| Token Security | Not checked |
| Veza | Not checked |
| Zscaler | Not checked |
Cross App Access (ID-JAG)
The identity provider brokers agent access between enterprise apps, so admins approve app-to-app agent connections centrally instead of users clicking consent screens.
Reference: MCP authorization extension
| 1Password | Not checked |
| Acuvity | Not checked |
| Aembit | Claimed |
| Arcade.dev | Not checked |
| Astrix Security | Not checked |
| Aurascape | Not checked |
| Auth0 | Not checked |
| Cisco | Not checked |
| CrowdStrike | Not checked |
| Descope | Claimed |
| Entro Security | Not checked |
| Harmonic Security | Not checked |
| Keycard | No public claim found |
| Lasso Security | Not checked |
| Microsoft | No public claim found |
| Natoma | Not checked |
| Nightfall AI | Not checked |
| Noma Security | Not checked |
| Oasis Security | Not checked |
| Okta | Claimed |
| Operant AI | Not checked |
| Palo Alto Networks | Not checked |
| Permiso Security | Not checked |
| Portkey | Not checked |
| Runlayer | Not checked |
| SailPoint | Not checked |
| SGNL | Not checked |
| Stytch | Claimed |
| Teleport | No public claim found |
| Token Security | Not checked |
| Veza | Not checked |
| Zscaler | Not checked |
Asynchronous human approval (CIBA)
The agent pauses and asks a person to approve a sensitive action on a separate device before it gets the token to proceed.
Reference: OpenID Connect CIBA
| 1Password | No public claim found |
| Acuvity | Not checked |
| Aembit | No public claim found |
| Arcade.dev | Not checked |
| Astrix Security | Not checked |
| Aurascape | Not checked |
| Auth0 | Claimed |
| Cisco | Not checked |
| CrowdStrike | Not checked |
| Descope | Claimed |
| Entro Security | Not checked |
| Harmonic Security | Not checked |
| Keycard | No public claim found |
| Lasso Security | Not checked |
| Microsoft | No public claim found |
| Natoma | Not checked |
| Nightfall AI | Not checked |
| Noma Security | Not checked |
| Oasis Security | Not checked |
| Okta | Not checked |
| Operant AI | Not checked |
| Palo Alto Networks | Not checked |
| Permiso Security | Not checked |
| Portkey | Not checked |
| Runlayer | No public claim found |
| SailPoint | Not checked |
| SGNL | Not checked |
| Stytch | Not checked |
| Teleport | Not checked |
| Token Security | Not checked |
| Veza | Not checked |
| Zscaler | Not checked |
MCP authorization conformance
MCP servers act as OAuth 2.1 resource servers: protected resource metadata (RFC 9728), PKCE, resource indicators (RFC 8707), client ID metadata documents before dynamic registration, and no token passthrough.
Reference: MCP specification 2025-11-25
| 1Password | Not checked |
| Acuvity | Not checked |
| Aembit | Claimed |
| Arcade.dev | Claimed |
| Astrix Security | Not checked |
| Aurascape | Not checked |
| Auth0 | Claimed |
| Cisco | Not checked |
| CrowdStrike | Not checked |
| Descope | Claimed |
| Entro Security | Not checked |
| Harmonic Security | Not checked |
| Keycard | Claimed |
| Lasso Security | Not checked |
| Microsoft | Claimed |
| Natoma | Not checked |
| Nightfall AI | Not checked |
| Noma Security | Not checked |
| Oasis Security | Not checked |
| Okta | Not checked |
| Operant AI | Not checked |
| Palo Alto Networks | Not checked |
| Permiso Security | Not checked |
| Portkey | No public claim found |
| Runlayer | Claimed |
| SailPoint | Not checked |
| SGNL | Not checked |
| Stytch | Claimed |
| Teleport | No public claim found |
| Token Security | Not checked |
| Veza | Not checked |
| Zscaler | Not checked |
Fine-grained authorization
Per-resource, per-action decisions, including permission-aware retrieval so an agent only reads documents the requesting user may see.
Reference: OpenFGA, Zanzibar-style ReBAC
| 1Password | Not checked |
| Acuvity | Not checked |
| Aembit | Claimed |
| Arcade.dev | Claimed |
| Astrix Security | Not checked |
| Aurascape | Claimed |
| Auth0 | Claimed |
| Cisco | No public claim found |
| CrowdStrike | Not checked |
| Descope | Claimed |
| Entro Security | Not checked |
| Harmonic Security | Claimed |
| Keycard | Claimed |
| Lasso Security | Not checked |
| Microsoft | Not checked |
| Natoma | Claimed |
| Nightfall AI | Claimed |
| Noma Security | Claimed |
| Oasis Security | Not checked |
| Okta | Not checked |
| Operant AI | Claimed |
| Palo Alto Networks | No public claim found |
| Permiso Security | Not checked |
| Portkey | No public claim found |
| Runlayer | Claimed |
| SailPoint | No public claim found |
| SGNL | Claimed |
| Stytch | Not checked |
| Teleport | Claimed |
| Token Security | Not checked |
| Veza | Not checked |
| Zscaler | No public claim found |
Short-lived, secretless credentials
Credentials are minted just in time and expire in minutes, so there is no standing secret to steal.
Reference: SPIFFE, workload identity federation
| 1Password | Not checked |
| Acuvity | Not checked |
| Aembit | Claimed |
| Arcade.dev | Not checked |
| Astrix Security | Claimed |
| Aurascape | Not checked |
| Auth0 | Not checked |
| Cisco | No public claim found |
| CrowdStrike | No public claim found |
| Descope | Claimed |
| Entro Security | Not checked |
| Harmonic Security | Not checked |
| Keycard | Claimed |
| Lasso Security | Not checked |
| Microsoft | Claimed |
| Natoma | Not checked |
| Nightfall AI | Not checked |
| Noma Security | Not checked |
| Oasis Security | Claimed |
| Okta | Claimed |
| Operant AI | Not checked |
| Palo Alto Networks | Not checked |
| Permiso Security | Not checked |
| Portkey | Not checked |
| Runlayer | No public claim found |
| SailPoint | No public claim found |
| SGNL | Not checked |
| Stytch | Not checked |
| Teleport | Claimed |
| Token Security | Not checked |
| Veza | Not checked |
| Zscaler | Not checked |
Token vault
Third-party tokens are held by a broker and never reach the model or the prompt context.
Reference: Brokered credentials
| 1Password | Claimed |
| Acuvity | Not checked |
| Aembit | Claimed |
| Arcade.dev | Claimed |
| Astrix Security | Not checked |
| Aurascape | Not checked |
| Auth0 | Claimed |
| Cisco | Not checked |
| CrowdStrike | Not checked |
| Descope | Claimed |
| Entro Security | Not checked |
| Harmonic Security | Not checked |
| Keycard | Claimed |
| Lasso Security | Not checked |
| Microsoft | Not checked |
| Natoma | Not checked |
| Nightfall AI | Not checked |
| Noma Security | Not checked |
| Oasis Security | Not checked |
| Okta | No public claim found |
| Operant AI | Not checked |
| Palo Alto Networks | Not checked |
| Permiso Security | Not checked |
| Portkey | Claimed |
| Runlayer | Claimed |
| SailPoint | Not checked |
| SGNL | Not checked |
| Stytch | Not checked |
| Teleport | Not checked |
| Token Security | Not checked |
| Veza | Not checked |
| Zscaler | Not checked |
Kill switch
An operator can revoke one agent, one tool, or every token an agent holds, in seconds, across systems.
Reference: Operational control
| 1Password | Not checked |
| Acuvity | No public claim found |
| Aembit | Claimed |
| Arcade.dev | Not checked |
| Astrix Security | Claimed |
| Aurascape | No public claim found |
| Auth0 | Not checked |
| Cisco | No public claim found |
| CrowdStrike | No public claim found |
| Descope | Claimed |
| Entro Security | Not checked |
| Harmonic Security | No public claim found |
| Keycard | Claimed |
| Lasso Security | No public claim found |
| Microsoft | Claimed |
| Natoma | Not checked |
| Nightfall AI | Claimed |
| Noma Security | No public claim found |
| Oasis Security | Not checked |
| Okta | Claimed |
| Operant AI | No public claim found |
| Palo Alto Networks | No public claim found |
| Permiso Security | Not checked |
| Portkey | Claimed |
| Runlayer | Claimed |
| SailPoint | Claimed |
| SGNL | No public claim found |
| Stytch | Not checked |
| Teleport | Not checked |
| Token Security | Not checked |
| Veza | Not checked |
| Zscaler | No public claim found |
Per-action audit chain
Every tool call is logged with the human, the agent, the tool, the data touched, and the decision, and can be exported to a SIEM.
Reference: Operational control
| 1Password | No public claim found |
| Acuvity | No public claim found |
| Aembit | Claimed |
| Arcade.dev | Not checked |
| Astrix Security | Not checked |
| Aurascape | No public claim found |
| Auth0 | Not checked |
| Cisco | No public claim found |
| CrowdStrike | Claimed |
| Descope | Not checked |
| Entro Security | Not checked |
| Harmonic Security | No public claim found |
| Keycard | Claimed |
| Lasso Security | No public claim found |
| Microsoft | No public claim found |
| Natoma | No public claim found |
| Nightfall AI | No public claim found |
| Noma Security | No public claim found |
| Oasis Security | No public claim found |
| Okta | Claimed |
| Operant AI | Not checked |
| Palo Alto Networks | No public claim found |
| Permiso Security | No public claim found |
| Portkey | No public claim found |
| Runlayer | Claimed |
| SailPoint | No public claim found |
| SGNL | Not checked |
| Stytch | Not checked |
| Teleport | Claimed |
| Token Security | No public claim found |
| Veza | Not checked |
| Zscaler | No public claim found |