OpenID Foundation Document Details Identity Management Challenges for Agentic AI

The provided text, associated with the OpenID Foundation, addresses security and governance challenges arising from the shift of AI agents from simple chatbots to autonomous actors. It highlights that while OAuth 2.1 and Model Context Protocol (MCP) provide a foundation, they struggle with high-autonomy, cross-domain, and asynchronous operations.

Key issues identified include:

• Identity Fragmentation: Vendors are creating proprietary agent identity systems, leading to security vulnerabilities and integration friction.
• Impersonation Risks: Agents often act indistinguishably from users, obscuring accountability. The text argues for true delegation where agents maintain distinct identities while proving they act "on-behalf-of" a user.
• Consent Fatigue: As agents multiply, manual approval of every action becomes impractical, risking reflexive approvals that bypass security controls.

The document proposes several technical approaches to resolve these gaps:

• Distinct Agent Identity: Moving beyond simple client IDs to include metadata about the agent’s model, version, and capabilities. Standards like SPIFFE/SPIRE are suggested for workload identity, though they lack cross-organization portability.
• Recursive Delegation & Scope Attenuation: Mechanisms to safely pass permissions down chains of agents. The text highlights Biscuits and Macaroons for offline scope attenuation and OAuth 2.0 Token Exchange for online down-scoping.
• Asynchronous Authorization: Client Initiated Backchannel Authentication (CIBA) is recommended for long-running tasks, allowing agents to request human approval out-of-band.
• Enterprise Integration: Extending SCIM with an "Agentic Identity Schema" to treat agents as first-class entities for provisioning and lifecycle management.

The text also identifies emerging needs for interoperable trust, including Web Bot Auth (an IETF proposal using HTTP Message Signatures) and integration with payment protocols like FAPI and Google’s AP2. It concludes that managing agent identity requires a shift from impersonation to true delegation and from siloed systems to interoperable trust frameworks.