Agent identity is the set of identifiers, credentials and permissions that lets a software system recognise an AI agent as a distinct actor: who operates it, which person or organisation it is acting for, and what it is allowed to do. Agents break the two identity models the web already had. A human logs in with a password or passkey; a crawler announces itself with a user agent string and, at best, a list of IP addresses. An agent that books a flight, reads a mailbox or completes a checkout is neither. It acts with delegated human authority, often from shared cloud infrastructure, and the systems it touches need to know whose authority that is before they let it through.

How agent identity works

The problem splits into three questions, and different standards answer each one.

The first is identification: naming the agent as a separate entity rather than letting it borrow a human account or a generic API key. In enterprise identity platforms that means a dedicated directory object. Microsoft Entra Agent ID, for example, creates "identity accounts within Microsoft Entra ID" for agents, distinct from the service principals that represent ordinary applications, according to Microsoft's documentation (updated June 15, 2026). Each agent can be paired one-to-one with an agent user account when it needs to reach systems that only accept users, and the person who created it is recorded as its sponsor, a named human accountable for it.

The second is authentication: proving, on each request, that the agent really is the one it claims to be. On the open web the leading mechanism is Web Bot Auth, a profile of HTTP Message Signatures (RFC 9421, published February 2024). The agent signs each request with a private key and attaches three headers: Signature, Signature-Input and Signature-Agent. The signature parameters must carry the tag "web-bot-auth" and a key identifier derived from a JSON Web Key thumbprint. The receiving site fetches the operator's public keys from a file at /.well-known/http-message-signatures-directory and checks the signature. Identity then travels with the request, not with the network address, which matters because many agents run in the same data centres as everyone else.

The third is authorisation and delegation: recording what the agent may do and on whose behalf. Most implementations build on OAuth 2.0. An IETF individual draft published on August 26, 2025 by Thilina Shashimal Senarath and Ayesha Dissanayaka of WSO2 shows the pattern. The authorisation request names the agent in a requested_actor parameter; the user consents; the token endpoint receives an actor_token identifying the agent; and the resulting access token carries an "act" (actor) claim, such as "act": {"sub": "actor-finance-v1"}, alongside the user as subject. The Model Context Protocol (MCP), which connects agents to tools and data, mandates OAuth 2.1 for remote servers in its November 25, 2025 specification, requiring servers to publish OAuth 2.0 Protected Resource Metadata (RFC 9728) so an agent can discover where to obtain a token.

Commerce adds a fourth layer. Visa's Trusted Agent Protocol and Mastercard's Agent Pay, both announced in October 2025, reuse Web Bot Auth but require agents to register and publish keys in directories hosted by the card networks. Requests are tagged agent-browser-auth when the agent is browsing and agent-payer-auth when it is paying, with a nonce to stop replay. Cloudflare validates the signatures at the network edge, so a merchant can distinguish a registered shopping agent from a scraper without changing its own code.

Who operates it

On the agent side, the operator holds the keys: OpenAI for ChatGPT agent, Google for Google-Agent, Anthropic, Perplexity and smaller agent builders. On the receiving side, verification usually happens in infrastructure the site owner rents rather than builds: CDNs and bot managers such as Cloudflare, Akamai and HUMAN, payment networks, and identity providers such as Microsoft, Okta and IBM. Advertisers meet it indirectly, through landing pages and checkouts that must decide whether an automated visit is a customer's delegate or invalid traffic.

Origin and evolution

The components are older than the term. OAuth 2.0 was published as RFC 6749 in October 2012, and its token exchange extension, which introduced the actor claim, as RFC 8693 in January 2020. SPIFFE (Secure Production Identity Framework for Everyone) emerged in the late 2010s to issue short-lived identity documents to microservices, part of what security vendors now call non-human identity.

Agent identity became a distinct problem in 2025, when agents that browse and transact moved from demonstrations to products. Cloudflare proposed Web Bot Auth on May 15, 2025, arguing that IP addresses should stop serving as identity. Microsoft announced Entra Agent ID in preview at its Build conference the same month; its documentation now describes the product as generally available. The OpenID Foundation published a whitepaper, "Identity Management for Agentic AI", on October 7, 2025, concluding that existing frameworks suffice for simple agents but that "the frameworks that secure today's agents weren't designed for recursive delegation chains", where one agent hands work to another. The card networks' protocols followed later that month, and the IETF chartered a working group for Web Bot Auth on October 23, 2025.

Governments joined in 2026. On February 5, 2026, the National Institute of Standards and Technology's National Cybersecurity Center of Excellence (NCCoE) published a concept paper on software and AI agent identity and authorisation, taking comments until April 2, 2026. Google added Google-Agent to its list of user-triggered fetchers on March 20, 2026, giving AI browsing on its infrastructure an official name, its own IP range file and an experimental Web Bot Auth identity at agent.bot.goog. The IETF group adopted the signing protocol as a working group document on September 1, 2026.

Why it matters for marketers

Agent identity determines whether a customer's delegate can reach a product page or complete a purchase. Blend Commerce tested an AI shopping agent against 200 UK and US retailers between September 8 and 15, 2026, and bot protection refused it at 29 of them, or 14.5%, rising to 20% among large retailers. The agent ran unmodified Chromium and carried no signature.

The reverse problem is equally visible. HUMAN Security's 2026 traffic report found agentic traffic grew 7,851% in 2025 and that only half a percentage point separated benign from malicious automation on its measures, which is why fraud and genuine agent purchases look identical without a credential. Signing remains rare. Arkose Labs found that in the third quarter of 2026 only 2.3% of AI agent sessions it classed as legitimate carried a verified Web Bot Auth signature; ChatGPT agent, which signed 78.4% of its sessions, was the only agent doing so at scale. Both sets of figures are vendor-published and unaudited.

For brands building their own agents, practice lags the standards. In Okta's 2026 Customer Identity Trends Report, 22.4% of organisations building agents gave each one a unique identity with tightly scoped, time-limited credentials. Shared or long-lived API keys accounted for 17.4%, inherited user tokens 11.5% and hardcoded credentials 6.4%. Gareth Davies, chief product officer of Auth0, summarised the shift: "For years, security teams focused on keeping bots out. Now, we have to let the good ones in."

Limitations and disputes

A valid identity proves who holds a key, not what the agent intends. Mitchell Davies, lead researcher at Arkose Labs, put the question directly: "The real question is, what did the agent come to do? What is its intent?" A signed agent can still scrape, overspend or act on a prompt injection planted in a web page.

The mechanisms also have gaps. Web Bot Auth has no revocation system beyond removing a key and waiting for caches to expire. Implementations diverge: Google and Cloudflare send incompatible forms of the Signature-Agent header, and payment tags sit alongside the base protocol's tag rather than within it. Delegation chains, where an agent spawns sub-agents, remain unsolved in standard OAuth, as the OpenID Foundation noted. The WSO2 draft expired on February 27, 2026 without adoption.

Vendor fragmentation draws criticism too. Forrester's Andras Cser and Geoff Cairns wrote on October 1, 2026 that Okta "still does not have a full SPIFFE agent identity implementation" and that its Cross App Access extensions are "not yet part of standards issued by a standards body." Critics also warn that small agent builders without registration at Cloudflare, Visa or Mastercard will be treated as bots by default.

Not the same as

User agent is the free-text HTTP header naming the software that sends a request. Any program can copy it, which is why agent identity relies on signatures and credentials instead.

Verified bot is a commercial status granted by infrastructure providers such as Cloudflare. A verified bot has passed identity checks plus behavioural rules; agent identity is the underlying credential, which can exist without any verification programme.

Non-human identity is the security industry's broader category for machine credentials: service accounts, API keys, certificates and workload identities. Agent identity is a subset that adds delegated human authority and accountability to a sponsor.

Identity resolution in advertising means linking devices, cookies and records to one consumer. It concerns people, not software acting for them. Contact centres also use "agent ID" for the login of a human customer service representative, an unrelated sense.

Recent developments

The UK Information Commissioner's Office issued a call for evidence on agentic AI on October 8, 2026, warning that "without a clear way to identify when an AI agent is operating," organisations cannot set appropriate controls, and asking about agent identification, authentication and scoped permissions, with responses due by November 20, 2026. IBM made its Agent Identity product generally available on October 26, 2026, issuing short-lived, task-scoped OAuth tokens. On October 27, 2026, NIST researchers Harold Booth, Bill Fisher, Ryan Galluzzo and Tom Clancy published ten design tenets for agent identity management systems, from distinct agent identification and delegation with attenuated permissions to short-lived, revocable authorisation and immutable evidence. "Guardrails alone are insufficient," one tenet states.

Timeline

  • October 2012: OAuth 2.0 published as RFC 6749
  • January 2020: OAuth 2.0 Token Exchange (RFC 8693) introduces the actor claim
  • February 2024: RFC 9421 HTTP Message Signatures published
  • May 15, 2025: Cloudflare proposes Web Bot Auth
  • May 2025: Microsoft announces Entra Agent ID in preview at Build
  • August 26, 2025: WSO2 authors publish the OAuth on-behalf-of draft for AI agents
  • October 7, 2025: OpenID Foundation publishes "Identity Management for Agentic AI"
  • October 2025: Visa Trusted Agent Protocol and Mastercard Agent Pay announced using Web Bot Auth
  • October 23, 2025: IETF charters the Web Bot Auth working group
  • November 25, 2025: MCP specification version requiring OAuth 2.1 authorisation for remote servers
  • February 5, 2026: NIST NCCoE concept paper on agent identity and authorisation
  • March 20, 2026: Google adds Google-Agent to its user-triggered fetchers
  • September 1, 2026: IETF working group adopts the Web Bot Auth protocol draft
  • October 1, 2026: Forrester assesses Okta's agent identity plans after Oktane
  • October 8, 2026: UK ICO opens call for evidence on agentic AI
  • October 26, 2026: IBM Agent Identity generally available
  • October 27, 2026: NIST publishes design tenets for agent identity management systems
  • November 20, 2026: ICO call for evidence closes

Summary

Who: Agent operators such as OpenAI, Google and Anthropic, which hold signing keys; identity providers such as Microsoft, Okta and IBM; payment networks Visa and Mastercard; infrastructure firms such as Cloudflare; and standards bodies including the IETF, the OpenID Foundation and NIST.

What: The identifiers, cryptographic credentials and delegated permissions that let systems recognise an AI agent as a distinct actor, prove each request comes from it, and record which person or organisation authorised its actions.

When: Built on OAuth (2012), token exchange (2020) and HTTP Message Signatures (2024), the concept took shape in 2025 with Web Bot Auth, Entra Agent ID and the card network protocols, and moved into standards and regulatory work through 2026.

Where: In HTTP request headers and edge bot management, in enterprise identity directories, in OAuth tokens passed to APIs and MCP servers, and in payment authorisation flows.

Why: Agents act with human authority from shared infrastructure, so neither passwords nor IP lists identify them. Without agent identity, sites cannot separate a customer's delegate from fraud, and organisations cannot audit what their own agents did, though identity alone does not establish intent.