Thread

Identity Management for Agentic AI [pdf] (2025)

77 points · 26 comments · cgeier

Loading the complete thread in the background. This saved snapshot is available now. Refresh

cgeier · 1790867497 · focus · HN ↗
Sorry for the heavy edit of the title, the original "Identity Management for Agentic AI: The new frontier of authorization, authentication, and security for an AI agent world" is much too long.
1. Seattle3503 · 1790869618 · focus · HN ↗
  I think the title should have a "2025" in it.
  1. cgeier · 1790869879 · focus · HN ↗
    agreed and fixed
canadiantim · 1790868485 · focus · HN ↗
Executive Summary (from the linked pdf)
The rapid rise of AI agents presents urgent challenges in authentication, authorization, and identity management. Current agent-centric protocols (like MCP) highlight the demand for clarified best practices in authentication and authorization. Looking ahead, ambitions for highly autonomous agents raise complex long-term questions regarding scalable access control, agent-centric identities, AI workload differentiation, and delegated authority. This whitepaper is for stakeholders at the intersection of AI agents and access management. It outlines the resources already available for securing today’s agents and presents a strategic agenda to address the foundational authentication, authorization, and identity problems pivotal for tomorrow’s widespread autonomous systems.
nephihaha · 1790869964 · focus · HN ↗
Is the OpenID Foundation connected to the Open Society group?
1. 0xWTF · 1790880223 · focus · HN ↗
  OpenID came out of Six Apart, the developer of Movable Type blogging software (They lost the betamax war of blogging to Wordpress) <a href="https://en.wikipedia.org/wiki/OpenID#History" rel="nofollow">https://en.wikipedia.org/wiki/OpenID#History
2. jbonatakis · 1790881879 · focus · HN ↗
  What makes you wonder about that other than the word "Open" in their names?
  1. nephihaha · 1790882610 · focus · HN ↗
    Well, the Open Democracy blog is part of the same group and so are a few other things. Always interesting where the main money comes from.
ChrisArchitect · 1790870998 · focus · HN ↗
Blog post with context: <a href="https://openid.net/new-whitepaper-tackles-ai-agent-identity-challenges/" rel="nofollow">https://openid.net/new-whitepaper-tackles-ai-agent-identity-...
VaultNet2027_bd · 1790871364 · focus · HN ↗
[dead]
x401throaway · 1790876692 · focus · HN ↗
I work at Proof, and we're working on x401 as a means for agentic authorization
<a href="https://x401.proof.com/spec/latest/#abstract" rel="nofollow">https://x401.proof.com/spec/latest/#abstract
in a nutshell:
* a website that wants to authorize who you are (say, to book a flight or sign a waiver for go kart rental)
* the endpoint returns 401 and defines in a header what info it needs about you (over 18? you're actually John Doe? etc.)
on the proof side specifically, we're putting IAL2 verification in front of this <a href="https://pages.nist.gov/800-63-3-Implementation-Resources/63A/ial2remote/" rel="nofollow">https://pages.nist.gov/800-63-3-Implementation-Resources/63A...
pretty cool stuff, its early days but its a strong way to ensure there's a human authorizing sensitive actions an agent is taking on your behalf
1. 0xWTF · 1790880413 · focus · HN ↗
  Uh, not sure I agree with your terminology - one does not authorize who you are. You authenticate yourself, certain tokens authenticate your identity with varying levels of strength (e.g. within a corporate enclave, you may have elevated authorizations if you are authenticating from a corporate device).
  Authorizations are what are granted to an authenticated identity, typically with a specified scope and duration.
  1. x401throaway · 1790881464 · focus · HN ↗
    thank you for the clarification - thankfully some much smarter people than I are working on the protocol aspects :)
    when I say `authorize who you are` I mean to say that you're saying both "hello I am in fact john doe" and "john doe the human is also saying this is ok to do".
    I think this is interesting in the lens of Muse, GrokBot, Dots, OpenClaw, etc; if my agent wanted to rent a car on my behalf, it would forcibly have to get approval from me to do so
    SgtBastard · 1790893282 · focus · HN ↗
    Authentication is (proving) who you are.
    Authorization is the process of determining if someone can do something.
    That you’re conflating multiple distinct concerns doesn’t build confidence.
    niyikiza · 1790963957 · focus · HN ↗
    Good point. Identity is not the same thing as authority. We're working on the authority piece at tenuo.ai (with a corresponding IETF protocol effort)
  2. Knufferlbert · 1790882682 · focus · HN ↗
    Maybe related. I was always confused with the authorization header and 401 status code (unauthorized).
    I've only ever seen authorization header containing credentials (i.e. authentication, who you are) instead of authorization (what you can do).
    Also everyone returns 401 when unauthorized (i.e. can't do a thing), instead of 403 (forbidden, i.e. can't do the thing). When 401 should probably be "unauthenticated" (we don't know who you are, so we can't authorize you).
    Always messes with my head a bit.
aidiveyt · 1790879328 · focus · HN ↗
[dead]
juanre · 1790882048 · focus · HN ↗
I wrote a solution for this, and it has been working across several organizations for some months now. I run it as a public service at <a href="https://awid.ai" rel="nofollow">https://awid.ai but I would love to offload it to a foundation.
- OSS (<a href="https://github.com/awebai/aweb/tree/main/awid" rel="nofollow">https://github.com/awebai/aweb/tree/main/awid)
- Trust rooted in the DNS.
- Multiple registries supported.
- did, verifiable stable identities.
- Certificate-based teams.
It is being a very interesting project so far. Its at the core of my <a href="https://aweb.ai" rel="nofollow">https://aweb.ai which enables agents to communicate globally, and it makes it possible to build really simple agent-first tools where auth is just a matter of validating a certificate.
1. dingaling911 · 1790933760 · focus · HN ↗
  Very cool but I'm not sure I understand why a specific service is needed to allow agents to communicate. Why not just email or chat?
2. brw · 1790935132 · focus · HN ↗
  [delayed]
bob1029 · 1790883128 · focus · HN ↗
[delayed]
1. tptacek · 1790884416 · focus · HN ↗
  I think you have to want that conclusion to read the document this way. This is enterprise authentication architecture stuff, and "agent-native identity" refers to how you designate an agent, session, whatever as a principal in an IAM system.
  1. hirsin · 1790891606 · focus · HN ↗
    The space is rife with folks asking big questions like "if I give an agent money to invest, I don't owe taxes on it because the agent did it, right?"
    I do enjoy asking people what they mean when they say they want to build an agent-native platform, because that work is rarely what they actually want to do.
    tptacek · 1790896304 · focus · HN ↗
    Are they 12? I assure you there's nobody at the IRS wondering about this.
2. ra · 1790893187 · focus · HN ↗
  [delayed]
iamjake648 · 1790883687 · focus · HN ↗
How does this releate (or not) to Okta/Auth0's XAA, Identity Assertion JWT Authorization Grant? I'm struggling to follow.
<a href="https://auth0.com/docs/ai-agents-mcp/cross-app-access" rel="nofollow">https://auth0.com/docs/ai-agents-mcp/cross-app-access
<a href="https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/" rel="nofollow">https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-a...
1. luka2233 · 1790963219 · focus · HN ↗
  XAA is a great improvement to where we were in 2025. It helps track user access to mcp tools. There is a few other ongoing efforts in the IETF community. Eg; <a href="https://datatracker.ietf.org/doc/draft-niyikiza-oauth-attenuating-agent-tokens/01/" rel="nofollow">https://datatracker.ietf.org/doc/draft-niyikiza-oauth-attenu... (implementation: <a href="https://github.com/tenuo-ai/tenuo" rel="nofollow">https://github.com/tenuo-ai/tenuo)
AIorNot · 1790886721 · focus · HN ↗
how does this relate to WebMCP
udbhavs · 1790887316 · focus · HN ↗
I've been working in this space with a small team that is also trying to solve this with open standards. There are many emerging protocols/standards and many dimensions to consider. I have a list of 50 standards using different primitives and flows, but it's hard to see which ones will stick around at this point.
You could split use cases by scope. One is internal organization and IAM cases, which makes it easy for you to use a centralized identity provider (IdP) to issue some sort of token grant access to an app.
Use cases where you don't want to fix an IdP, like payments or verifying the someone's credentials before giving access on the open web, get more involved. You could have multiple valid IdPs, reputation / claims linked to IDs (since being on the IdP itself is no longer sufficient for an app to let the actor through), inheriting authority through multiple hops (giving your authorization to someone), enforcing narrowing permissions for those use cases, handling revocations. And then there's also the matter of being compatible with other emerging standards that are coming up (eg. A2P for agent payment authorization).
We settled on the core primitives of W3C DIDs for identity, Verifiable Credentials for delegations, and StatusList bitstrings for revocations as the "minimal set of ingredients" that address all the above. They are all open standards. DIDs are particularly cool because you can have them bound to passkeys, web domains through existing PKI, and even ledgers.
We did need to add a few specs of our own on top to address how it would work with use cases like MCP (for replacing OAuth flows, which have had messy implementations on coding agents since inception.) Our MCP example [0] also tries to make it incrementally adoptable and work alongside OAuth, so for example an operator could add it as a wrapper today and start collecting logs with identity claims for each tool call for auditability. It's a work in progress so hearing feedback on what seems confusing / hard to understand would be helpful.
[0] <a href="https://github.com/decentralized-identity/kya-os-mcp" rel="nofollow">https://github.com/decentralized-identity/kya-os-mcp
deepinquiry · 1790898378 · focus · HN ↗
[dead]
cleochan · 1790912454 · focus · HN ↗
[dead]
niyikiza · 1790963482 · focus · HN ↗
We are working on Tenuo[1] which is basically macaroons for agents. It uses capability-based cryptographic "warrants" as an authorization mechanism for multi-hop delegation. Rust core. Apache2.0
[1] <a href="https://github.com/tenuo-ai/tenuo" rel="nofollow">https://github.com/tenuo-ai/tenuo

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.