Identity Management in the Agentic AI Era: A Deep Dive into the OpenID Foundation White Paper

When AI Starts Acting Autonomously, How Do We Define Identity?

The OpenID Foundation has published a white paper focused on identity management for Agentic AI, bringing a long-overlooked question to the forefront: when AI is no longer passively responding to commands but can autonomously plan, invoke tools, and execute tasks on behalf of users, is traditional Identity and Access Management (IAM) still sufficient?

The answer is clearly no. Legacy identity management was designed around two types of principals — human users and service accounts. The former log in via passwords and multi-factor authentication; the latter communicate machine-to-machine via API keys or service tokens. But agentic AI is neither purely human nor a simple service process: it initiates actions on behalf of a user, exercises a degree of autonomous decision-making, and may chain calls across multiple systems. This ambiguity of "proxy identity" is precisely the core issue the white paper aims to clarify.

Why Agentic AI Introduces Entirely New Identity Challenges

The central assumption of traditional IAM is that the intent of an acting principal is clear and traceable. A user clicks to log in — the system knows who it is. A service calls an API — the system knows which service. Agentic AI breaks this chain.

Blurred Boundaries of Delegation and Authorization

When a user authorizes an AI agent to "manage my schedule and book meeting rooms," the agent may need to access multiple resources during execution — calendars, email, room booking systems, and more. The questions quickly pile up: should the agent inherit the user's full permissions, or only receive the minimum permissions necessary to complete the specific task? If the agent calls another agent during execution, how should the authorization chain be passed down and converged?

This is precisely where the concept of "delegated authorization" in OAuth needs to be extended. The white paper emphasizes that an agent's permissions should dynamically converge based on task context rather than inheriting the user's complete permissions all at once — otherwise, if the agent is hijacked or behaves unexpectedly, the attack surface becomes effectively unlimited.

OAuth (Open Authorization) was originally designed to solve the problem of "third-party applications accessing resources on behalf of a user" — for example, allowing an app to read your Google Calendar. Its core mechanism is that the user grants authorization to an authorization server in exchange for an Access Token, which the third party uses to access resources within a defined scope, without ever knowing the user's actual password. However, OAuth's design premise is that authorization relationships are relatively static and flat: user → third-party app → resource server. Agentic AI breaks this assumption, as it may involve multi-level nested delegation (user → primary agent → sub-agent → tool API), with different permission boundaries, lifecycle requirements, and audit needs at each level. Existing OAuth extension drafts (such as RFC 8693 Token Exchange) provide some token exchange capabilities, but are not yet sufficient to natively express complex multi-level delegation semantics — which is the context behind the white paper's call for further protocol extensions.

Traceability and Accountability

When an autonomous agent completes a series of operations, what does the system log record — "the user did this" or "the AI did this"? This is not merely a technical question; it touches on the attribution of legal liability. The white paper argues that identity systems must be able to distinguish between "authorized by a human principal" and "actually executed by an agent," ensuring every action can be traced back to a specific delegation chain.

The OpenID Foundation's Core Proposals

Rather than dismantling existing standards, the white paper advocates extending mature protocols like OAuth 2.0 and OpenID Connect to accommodate agentic scenarios. Several key directions are worth highlighting.

Assigning Independent Identities to Agents

Agents should have their own verifiable identity credentials rather than simply reusing user credentials. This makes it clear "which agent is acting," and also makes it easier to apply policy constraints, rate limits, and permission boundaries to specific agents.

Fine-Grained, Short-Lived Tokens

Given the autonomy and potential risks of agent behavior, the white paper advocates for access tokens with extremely narrow scopes and very short lifespans. Tokens should be bound to specific task contexts and expire upon task completion, minimizing the persistent risk posed by credential leakage.

The "scope" of an access token is the core mechanism in the OAuth framework for controlling permission granularity — developers declare different scopes to restrict which resources a token can access and what operations it can perform. In practice, however, many systems tend to request overly broad scopes for convenience, meaning a leaked token has far more capability than actually needed. For agentic AI, this problem is amplified — agents may hold tokens for extended periods and use them across multiple sub-tasks, allowing an attacker who hijacks a token to continuously manipulate resources without the user's knowledge. The Principle of Least Privilege requires that systems grant only the minimum permissions necessary to complete a specific task. Combined with short expiration windows (e.g., on the order of minutes) and revocation upon task completion, this approach compresses the potential damage of a single token leak into the smallest possible window.

Cryptographically Verifiable Expression of Delegation Chains

From the human user to a primary agent, and then to invoked downstream agents, the entire authorization delegation chain needs to be expressed in a cryptographically verifiable manner. This means every level can prove that its permissions originated from a legitimate upstream authorization, rather than being obtained out of thin air.

Cryptographic verifiability in identity systems is typically achieved through digital signatures: the authorizing party signs an authorization claim with their private key, and downstream systems verify the signature using the corresponding public key, proving that the claim genuinely came from a legitimate upstream source and was not forged or tampered with. In the web identity space, JWT (JSON Web Token) is the common format for carrying such signed claims, and OpenID Connect uses JWT as its core mechanism for conveying user identity information. Extending this mechanism to agent delegation chains means every level of agent must carry a verifiable "proof of authorization origin," allowing resource servers to validate the legitimacy of the entire delegation chain layer by layer before responding to a request. This is technically feasible, but introduces engineering challenges such as increased token size and greater verification complexity — the details of the relevant standards are still under discussion.

What This White Paper Means

As more and more products tout "AI agents" as a key selling point, security and identity questions are moving from theoretical discussion into engineering practice. The OpenID Foundation's involvement — as the steward of critical standards like OAuth and OpenID Connect — carries symbolic weight. It signals that agentic identity management will likely evolve along the trajectory of existing web identity standards, rather than starting from scratch.

For enterprises and developers, understanding these principles early has real practical value. If your systems are about to incorporate autonomous AI capabilities, now is the time to ask: How do you assign independent identities to agents? How do you enforce least privilege within the authorization chain? How do you ensure every autonomous action is auditable? The answers to these questions will determine whether agentic AI can be genuinely trusted in enterprise environments.

It's worth noting that this document is still at a relatively early stage, with limited community discussion (only a handful of comments on HackerNews). The maturation of standards, the completeness of toolchains, and adoption by major vendors will all take time. But the direction is clear: the large-scale deployment of agentic AI depends on a dedicated identity trust infrastructure designed specifically for it.