#identity

4 resources and 4 guides tagged #identity on ChangeGamer.

Agent Identity and Authentication · Guide
How autonomous agents prove who they are and get authorized to act: workload identity vs. delegated authority, SPIFFE/SPIRE, cloud workload federation, OAuth token exchange, audience binding, and emerging standards — with practical guidance and verified sources.
Agent Delegation Chains: Credential Propagation in Multi-Agent Systems · Reference
How credential authority flows when one agent spawns another — the multi-hop delegation problem, RFC 8693 token exchange, the act/may_act claims, audience binding across hops, and the IETF drafts standardizing verifiable actor chains in 2026.
Web Bot Auth: Cryptographically Verifying AI Crawlers and Agents · Reference
How Web Bot Auth — Cloudflare's implementation of IETF HTTP Message Signatures (RFC 9421) — lets a crawler or agent cryptographically prove its identity to a website, replacing the spoofable User-Agent string and brittle IP allowlists.
MCP Enterprise-Managed Authorization: Zero-Touch SSO via ID-JAG (SEP-990) · Reference
What Enterprise-Managed Authorization is: the MCP extension (SEP-990) that lets an IdP grant MCP server access during SSO instead of a per-server OAuth consent screen — the ID-JAG mechanism, the RFCs it builds on, and how it layers on standard MCP OAuth 2.1.

Guides

Agent Spend Limits and Trust: What a Seller Should Verify Before Granting Access · guide
The seller-side counterpart to agent spend controls — how an API operator reads an inbound agent's spend ceiling before granting access, which payment protocols actually prove that ceiling, how to revoke access, and what "trust" operationally means for a seller when no portable agent-reputation standard exists yet.
Fraud and Abuse from AI Agent Traffic: What a Seller Should Detect · guide
How a seller of APIs, content, or tools to AI agents spots and mitigates abuse once access is already granted — key sharing, over-scope scraping, spend-ceiling circumvention, spoofed identity, and rate-limit evasion patterns specific to autonomous agents.
Zero-Touch Enterprise Authorization for MCP Servers: ID-JAG and SEP-990 · guide
How Enterprise-Managed Authorization (SEP-990) removes the per-server OAuth consent screen for MCP servers: the ID-JAG grant mechanism, its RFC 8693/7523 building blocks, named launch adopters as of August 2026, and how it layers on top of standard OAuth 2.1 rather than replacing it.
How AI Agents Prove Identity and Delegated Authority · guide
The two-layer model an autonomous agent needs to pass before any credential-custody or permission question even applies: a cryptographic workload identity proving what it is (SPIFFE/SPIRE, cloud workload identity federation) and a separate delegated-authority grant proving it may act on a human's or org's behalf (OAuth scopes, RFC 8693 token exchange, RFC 8707 audience binding).