One Year of the SCIM Agent Identity Draft: Lessons from Competition to Consolidation

From Two Competing Drafts to One Unified Standard

A year ago, two competing SCIM drafts existed within the IETF, each attempting to define how the SCIM protocol should represent AI agents. At the time, companies were jockeying for influence over the identity standard, each hoping their approach would become the de facto industry standard.

Today, the landscape has shifted fundamentally — companies that once competed are now co-authoring the same draft. This transition from rivalry to collaboration is itself a noteworthy signal in the AI agent identity standardization process.

For readers unfamiliar with the background: SCIM (System for Cross-domain Identity Management) is an open standard for automating the exchange of user identity information. It has long been used to synchronize user accounts, permissions, and identity attributes across enterprise systems. As AI agents begin accessing systems, calling APIs, and executing tasks much like human users do, establishing identity representations for these non-human entities has become an urgent practical problem.

The SCIM protocol itself originated around 2011 and was formally standardized in 2015 through three documents — RFC 7642, 7643, and 7644. Its core design philosophy uses REST-style HTTP interfaces with a JSON-based resource model to replace the hodgepodge of proprietary solutions that previously existed in enterprise directory synchronization. A typical use case: when an employee joins a company, the HR system automatically pushes account information to SaaS applications like Salesforce, GitHub, and Slack — no manual provisioning required. The IETF (Internet Engineering Task Force) is the primary international body responsible for developing Internet technical standards; its published documents are called RFCs (Requests for Comments). Before an RFC is officially published, the Internet-Draft stage can last months or even years, during which working groups discuss, publicly review, and revise proposals through multiple rounds. Understanding this context helps clarify why the draft merger is a critical milestone — not a final conclusion.

Why AI Agents Need an Identity Standard

AI agents differ fundamentally from traditional service accounts or machine identities. They may act on behalf of a user or make autonomous decisions; their permission boundaries require dynamic management, and their behavior needs to be audited and tracked. Without a unified identity representation standard, every vendor ends up building their own incompatible silo.

The core goal of extending SCIM to AI agent scenarios is to allow agent identities to be consistently recognized, provisioned, and revoked across different identity providers, application systems, and security platforms — just as human user identities are today. This is especially critical for enterprise security governance: when thousands of AI agents are running in an enterprise environment, administrators need a standardized way to understand who (which agent) is accessing which resources under what authorization.

The Real-World Pressure for Standardization

As AI agent deployments scale rapidly across enterprises, the governance risks from the absence of standards are amplifying. Identity is the first line of defense in a security architecture. If agent identities cannot be managed in a normalized way, problems like permission sprawl, unauthorized access, and gaps in audit trails will follow. This is the deeper motivation driving IETF's work on these drafts.

Traditional machine identities typically exist as service accounts or API keys — with relatively fixed permissions and lifecycles managed manually. AI agents introduce new complexity: a single agent might dynamically call multiple downstream systems during task execution, act on behalf of different users, or even spawn sub-agents that form invocation chains. This makes traditional static permission models difficult to adapt. Key problems the SCIM for AI draft attempts to solve include: how to represent an agent's "delegation relationship" within the SCIM resource model (i.e., which human user or organization the agent acts on behalf of), how to describe an agent's capability boundaries, and how to achieve unified lifecycle management when an agent migrates across systems or is deprovisioned. These requirements overlap with human user identity management in some ways, yet differ fundamentally in others — which is why extending the existing SCIM schema is necessary rather than simply reusing it.

The Industry Logic Behind the Shift from Competition to Consolidation

The merger of two competing drafts into one reflects a shared realization among participants: in the nascent field of AI agent identity, fragmented standards hurt everyone. The value of competing for standardization lies in winning definitional authority — but if the outcome is multiple incompatible approaches, the entire ecosystem's adoption rate suffers.

For identity management vendors, a widely accepted unified standard is far more commercially valuable than a proprietary "standard" that no one else follows. Once all parties recognized that the market needs interoperable infrastructure — not competing proprietary solutions — co-authoring a single draft became the rational choice.

This pattern of evolution is not unusual in the history of Internet standards. Many protocols now considered foundational went through early periods of competing proposals before being coordinated through neutral platforms like the IETF. The SCIM for AI draft merger is simply the latest instance of this pattern playing out in the AI era.

The history of Internet standards offers instructive parallels. In the early directory services wars, X.500 and LDAP long coexisted before LDAP won the market with its lighter-weight implementation. The identity federation space saw three-way competition among SAML, OpenID, and WS-Federation, with OpenID Connect ultimately winning in consumer internet contexts while SAML persisted in enterprise settings. Every such consolidation typically required a neutral coordinating body to intervene, along with recognition by major vendors that interoperability itself has commercial value. The companies currently participating in the SCIM for AI draft include players from identity providers, cloud platforms, and the AI application layer — parties whose commercial interests are not perfectly aligned. The move toward joint authorship is partly driven by enterprise customers beginning to include "open standards compliance" in their procurement evaluation criteria, creating market-side pressure.

What This Means for Enterprises and Developers

The draft merger is good news for technical decision-makers in the field. It reduces the risk of "betting on the wrong standard" — when the industry's major players converge on the same direction, the tools, integrations, and best practices built around that standard mature more quickly.

For enterprises planning AI agent deployments, it's worth tracking the IETF draft's progress and building in room for SCIM identity system integration at the architecture design stage. For developers and security teams, understanding how agent identities are represented, provisioned, and governed will be essential knowledge for building trustworthy AI systems.

One thing to be clear-eyed about: the draft merger is a milestone on the standardization journey, not the destination. There is still a considerable distance to travel from draft to official RFC, and from RFC to widespread adoption. The real test is whether this unified draft can hold up under the scrutiny of large-scale real-world deployment.

Conclusion

The SCIM for AI draft's evolution from competition to consolidation over the past year is a positive signal that AI agent identity standardization is maturing. It reflects both the industry's urgent need for a unified standard and demonstrates that neutral organizations can viably coordinate competing interests. For practitioners focused on AI infrastructure, this standardization trajectory is one worth continuing to follow.