The Future of AI Agent Security, ID-JAG

As AI agents enter an era where they perform tasks on behalf of users—querying internal DBs, sending messages, creating tickets—existing authentication and authorization structures are growing more complex and risky at the same time. Representative problems include consent fatigue from repeated approval popups, shadow AI referring to unapproved connections, and token sprawl, the scattering of tokens and credentials.

ID-JAG (Identity Assertion JSON Web Token Authorization Grant) is a new standard candidate aimed at solving these problems centered on the Enterprise IdP. It extends the IdP trusted in SSO to API access as well: the IdP issues a JWT signed by itself as a kind of "letter of introduction," and the target service's Authorization Server trusts this to issue the final access token.

The core flow is as follows.

• The Requesting Agent presents the ID token obtained via user SSO to the IdP.
• The IdP evaluates policy and issues an ID-JAG.
• The Agent submits this ID-JAG to the target Authorization Server to obtain an access token.
• That access token is used to call the Resource Server API.

This structure combines RFC 8693 OAuth 2.0 token exchange with RFC 7523 JWT profile for OAuth 2.0 authorization grants. The key shift is that the center of authorization decisions moves from relationships between individual apps to the trust relationship between the organization-managed enterprise IdP and each service.

The benefits of adoption are clear as well.

• Improved UX: Reduces the consent screens that used to pop up per app, easing approval fatigue.
• Stronger audit traceability: Access by which agent on behalf of which user with which scope can be logged in a centralized way at the IdP.
• Centralized control: Unapproved connections or excessive scopes can be blocked via IdP policy.
• Reduced token sprawl: Instead of issuing separate refresh tokens excessively, the ID-JAG can be resubmitted as needed, reducing the proliferation of long-lived credentials.

However, since this is still at the Internet-Draft stage, it is risky to tie it directly into core architecture as-is. For actual adoption, prior registration and trust relationships are needed between the requesting agent, the IdP, and the Authorization Server, and it is recommended to use it centered on confidential clients. On the other hand, for public clients, it is more appropriate to maintain the existing authorization code grant and interactive consent flow.

Also, during operation, step-up authentication requiring additional authentication may occur, and if the authentication context is insufficient per policy, it may return as an error. Ultimately, ID-JAG is an attempt to redesign authorization for the age of AI agents into a more centralized and auditable form.