Agent Identity and Authentication in Distributed Systems

The Assumptions Baked into OAuth, OIDC, and SAML That Agents Immediately Violate

OAuth 2.0, OIDC, and SAML were designed for a deterministic world: one entity, one session, a bounded set of actions, a clean exit. Autonomous agents violate every one of those assumptions at once, and they do it continuously, at machine speed, without asking permission.

The single-principal assumption goes first. These protocols model one entity per session. There is no native concept of an agent acting on behalf of a human while simultaneously spawning sub-agents acting on its behalf, because when these protocols were written, no such chain existed. That is not an oversight; it is a design boundary that made perfect sense at the time and makes no sense now.

The session-based trust model goes next. A token granted at authentication is assumed to remain contextually appropriate for its entire lifetime. A human logging into a CRM and browsing contact records validates that assumption reasonably well. An agent chaining API calls across a dozen downstream systems, in contexts the authorizing user never anticipated and could not have specifically approved, breaks it silently and continuously. The token looks fine. The behavior is not.

Then there is the static permission model. Service accounts and OAuth clients are registered once with fixed scopes. Agents need permissions that shift with task, context, and delegation depth in real time. ISACA's 2025 analysis of IAM protocols applied to multi-agent settings identified the pattern: coarse-grained permissions, single-entity assumptions, limited non-human identity support, no contextual adaptability. When those coarse-grained permissions are inherited wholesale by an agent operating at machine speed, "coarse-grained" becomes a polite way of saying "dangerous by design."

None of these protocols were wrong for their intended use. They are wrong when applied unchanged to autonomous, ephemeral, delegating agents. The instinct to retrofit is almost always cheaper than the instinct to redesign. Here, the cheaper instinct is the one that will actually cost you.

What the Multi-Hop Delegation Chain Exposes That Single-Agent Auth Cannot See

Authenticating a single agent is a tractable problem. The breakdown happens when Agent A spawns Agent B, which calls Agent C, which touches production data. Each hop in that chain is currently an unauthenticated leap of faith dressed up as a routine API call.

Consider the infrastructure those agents are operating through. A Knostic security scan of approximately 2,000 MCP servers found that every single one lacked authentication. MCP, the Model Context Protocol, is the de facto standard for agent-to-tool connections; there were over 13,000 MCP servers on GitHub in 2025. The most widely adopted mechanism for connecting agents to the tools they act through has no auth layer. Not an insufficient one. None.

Google's A2A protocol, backed by more than 50 enterprise partners, defines how agents communicate. It does not define who they are. A2A agent cards contain self-declared identities with no attestation binding. An agent can assert anything about itself, and there is currently no cryptographic mechanism to verify that assertion. This is the equivalent of letting someone into the building because they said they work there.

When Agent A delegates to Agent B under current protocols, no mechanism verifies that A had the authority to delegate in the first place; nothing constrains B's scope to the original task; no record of the delegation is created for audit purposes. Per AIP research on agent identity provisioning, this is the structural gap at the heart of multi-agent authentication. The chain is real. The accountability is not.

Privilege inheritance compounds everything. An agent that inherits a broad human-scoped token and passes a derivative downstream can silently escalate privilege across the chain. Entro Security's 2025 State of NHI report found that 97% of non-human identities carry excessive privileges, which means the token an agent inherits is over-scoped before delegation even begins. The blast radius is baked in at issuance.

The consequence is measurable. Cisco Talos reported that identity-based attacks accounted for 60% of all incident response cases in 2024. The multi-hop delegation chain is not an abstract architectural concern. It is where attacks concentrate, because it is where visibility disappears.

The Credential Hygiene Crisis That Autonomous Agents Inherit and Accelerate

The credential hygiene problem predates agents entirely. Agents make it worse, faster, at a scale that manual processes cannot observe in real time, let alone address.

Entro Security's 2025 State of NHI report put numbers to what security teams already sense: 44% of tokens are exposed through platforms like Teams, Jira, Confluence, and code commits; 60% of non-human identities are stale, issued and never rotated or revoked; 92% of organizations expose non-human identities to third parties. Forty percent of security leaders reported an NHI-related incident in the past year. Thirty-two percent said they could not determine whether they had experienced one.

Sit with that last number. Nearly a third of security leaders lack the visibility to know whether they have been breached through a non-human identity pathway. That is a monitoring gap so severe it constitutes the absence of monitoring, and it predates the agentic workload that is about to make the problem significantly worse.

Manual credential management was already failing at human-identity scale. At a 144:1 non-human-to-human identity ratio, a figure Entro Labs documented in their H1 2025 NHI and Secrets Risk Report, manual management is not a solution; it is an aspiration nobody has the headcount to pursue. The volume and velocity of credential issuance in agentic environments are categorically incompatible with any process requiring a human to initiate, approve, or review rotation.

What agents specifically add is directionality. A human whose token is compromised takes a bounded set of actions before someone notices, or before the human simply stops working. An agent with a compromised token acts at machine speed until it is detected or stopped. CrewAI's platform has executed more than 60 billion agent runs in total, with over 100,000 multi-agent execution groups per day, which illustrates what "machine speed" actually means in production. The exposure window for a compromised token in that environment is not measured in hours. The blast radius scales with autonomy, which is precisely the property agents are being deployed to maximize.

Any robust model must address the full credential lifecycle — issuance, rotation, revocation, and real-time scope enforcement — at every point in the chain, not just the front door.

What the Emerging Protocol Stack Is Trying to Solve, and Where Each Piece Falls Short

Three approaches dominate current proposals. None is sufficient alone, and treating any one of them as a complete answer will cost engineers time they do not have. The field is converging on layered combinations — the right instinct, even if execution is still catching up to theory.

The OAuth extension path is the most immediately deployable. MCP's November 2025 specification mandates OAuth 2.1 for remote server authentication. OAuth 2.0 Rich Authorization Requests allow agents to express fine-grained authorization needs in structured, business-readable terms rather than coarse scope strings — a genuine improvement over what came before. The token exchange profile, specifically the on-behalf-of pattern, cryptographically binds an acting agent to its delegating principal and preserves the chain of responsibility across hops. These are real improvements. The ceiling is also real: OAuth 2.1 still requires centralized authorization servers, and extending it to embed and track authority across multi-hop spawning chains works against the grain of what the protocol was designed to do.

SPIFFE and SPIRE take a more foundational approach, deriving identity from attestation rather than distributing it as a secret. SVIDs — the cryptographically bound identity documents SPIFFE issues — are tied to the workload through X.509 or JWT and rotate automatically. Production deployments at Uber, Stripe, and Netflix validate that the model works at infrastructure scale. The ceiling here is operational. X.509 issuance latency is incompatible with ephemeral agent creation at the scale agentic platforms already operate, and SPIRE requires dedicated attestation infrastructure that most teams are not carrying. It also provides no cross-protocol identity flow for agents operating across organizational boundaries, which is precisely where the interesting threat surface lives.

Decentralized identifiers and Verifiable Credentials address the cross-organizational scenario most directly. W3C DIDs are globally unique, persistent, cryptographically verifiable identifiers that agents can control without a central issuer. Verifiable Credentials enable granular, dynamic proof of capabilities and authorization with embedded validity periods, which is conceptually the right model for multi-agent scenarios spanning organizations. The ceiling is latency and bootstrapping: on-chain DID registration carries roughly 15-second confirmation latency per the AgentDID research, a genuine constraint for high-frequency ephemeral agents. The circular trust bootstrapping problem remains unresolved.

NIST's NCCoE issued a concept paper in early 2026 proposing a demonstration project combining OAuth 2.0, SPIFFE/SPIRE, and MCP. That is an early signal of where formal guidance is heading: not a single protocol, but a composed architecture — one engineers building today should take seriously, even if the full framework is not yet there to follow. The honest read is that standards bodies are acknowledging, in their characteristically measured way, that no single protocol will solve this.

The Ephemeral-Versus-Persistent Identity Split That Any Robust Model Must Accommodate

Not all agent identities have the same lifecycle, and conflating them is where existing non-human identity management practices fail most specifically when applied to agents. The failure is quiet, accumulating in the gap between what the process assumes and what the environment actually produces.

A persistent orchestrator agent running continuously has identity requirements resembling those of a long-lived service account: stable credentials, audit history, policy bindings that accumulate over time. An ephemeral sub-agent spun up to complete a single step in a workflow and then destroyed has entirely different requirements: scoped credentials, automatic expiration, and an instantiation rate that can reach thousands of simultaneous instances. These are not variations on the same problem. They are different problems that happen to share the label "non-human identity," and treating them identically is where policy breaks down.

Applying long-lived service account logic to ephemeral agents produces one of two failure modes. Either credentials are over-provisioned to avoid the operational overhead of granular issuance, which is dangerous, or registration processes that cannot keep pace with instantiation rates create gaps where agents operate without proper identity binding at all. Both outcomes are common — and avoidable with deliberate design separation rather than a uniform policy applied to everything labeled "non-human."

The design principle that actually resolves this is clean separation. Persistent identities anchor trust: they carry the delegation authority chain, the audit history, and the policy bindings. They warrant rigorous attestation and governance because a compromised persistent identity is the consequential exposure. Ephemeral identities should be scoped to a single task, time-boxed, and automatically revoked at completion. SPIFFE's SVID model approaches this correctly for infrastructure workloads; the challenge specific to agents is that "ephemeral" can mean seconds to minutes at scales of thousands of simultaneous instances, which strains even SPIFFE's issuance speed.

The minimal attack surface argument resolves the design question without much ambiguity: a compromised ephemeral identity expires on its own schedule, bounding the damage by construction. The practical rule that follows is straightforward. Ephemeral agents should never inherit broad human-scoped tokens. They should receive task-scoped tokens derived through token exchange from a properly attested persistent identity, constraining scope and blast radius at the architecture level rather than relying on runtime monitoring to catch drift after the fact.

What Runtime Monitoring Must Cover That Authentication Alone Cannot

Authentication answers one question: who is this agent? It cannot answer the question that actually matters once the token is issued: whether this agent is doing what it was authorized to do.

The gap is structural. A token correctly issued at authentication time can be used legitimately for the first action in a sequence and then used to trigger downstream actions in contexts the authorizing user never anticipated. The token does not change. The behavior does. OAuth's authorization model has no native mechanism to detect or prevent that drift after issuance, a limitation that recent security literature on agentic system design has documented consistently.

Runtime monitoring in an agentic context must cover territory that authentication cannot reach. Behavioral anomaly detection: action rates that exceed what the delegating task plausibly requires, scope creep across API calls, access to resources outside the expected execution path. Policy enforcement at the action level rather than only at token issuance, because a token authorizing file read access does not mean every file read in every context is authorized. And delegation chain logging that survives the full multi-hop sequence: without a complete, tamper-evident record of which agent did what, on whose delegation, with what scope, and at what time, both compliance and incident response are working blind. These are not enhancements. They are the difference between a security posture and a security story told after the fact.

The NHI access management market is projected to grow from roughly $11 billion in 2025 to $27 billion by 2033, per MarketsandMarkets data cited by the Cloud Security Alliance — reflecting enterprise recognition of exactly this insufficiency. The investment is in governance across the full lifecycle, not better front doors.

The architecture that actually works is sequential, and each layer is load-bearing: authentication establishes identity and initial scope; policy enforcement constrains what the agent can actually do at runtime; monitoring detects deviation from authorized behavior; audit logs make the full chain reconstructable after the fact. Pull any one layer out and the others are theater. The agents will not notice. The attackers will.