Ory Team states traditional IAM frameworks (MFA, SSO, fixed API keys, IP whitelisting) are insufficient for autonomous AI agents entering production, as these agents reason, use tools, and execute multi-step workflows without constant human intervention.
The article describes six identity capabilities for securing these agents: verifiable cryptographically-signed agent identities with delegation chains, just-in-time ephemeral credentials, relationship-based access control bound to task intent, machine-speed automated containment via circuit breakers, in-the-loop runtime policy enforcement with configurable human approvals, and a web-scale identity control plane that handles machine-speed throughput and rapid sub-agent lifecycle governance.
- Sponsored post by Ory; Insight Partners (TNS owner) is an investor in both Ory and TNS.
- Ken Buckler (EMA Research Director) is quoted: "most organizations are woefully unprepared" for the security risks of managing agentic identities.
- A comparison table contrasts agents with humans and service accounts across velocity, decision logic, auth mechanics, and access granularity, highlighting that agents need ephemeral delegation and contextual attestation rather than passkeys or static keys.
- The ReBAC example given: "Agent X may read Document Y only if human user Z is the document owner and the active workflow is 'Data Summarization'."
- PKCE and strict token-binding are called out to prevent credential replay outside the agent's intended runtime context.
The article describes six identity capabilities for securing these agents: verifiable cryptographically-signed agent identities with delegation chains, just-in-time ephemeral credentials, relationship-based access control bound to task intent, machine-speed automated containment via circuit breakers, in-the-loop runtime policy enforcement with configurable human approvals, and a web-scale identity control plane that handles machine-speed throughput and rapid sub-agent lifecycle governance.
- Sponsored post by Ory; Insight Partners (TNS owner) is an investor in both Ory and TNS.
- Ken Buckler (EMA Research Director) is quoted: "most organizations are woefully unprepared" for the security risks of managing agentic identities.
- A comparison table contrasts agents with humans and service accounts across velocity, decision logic, auth mechanics, and access granularity, highlighting that agents need ephemeral delegation and contextual attestation rather than passkeys or static keys.
- The ReBAC example given: "Agent X may read Document Y only if human user Z is the document owner and the active workflow is 'Data Summarization'."
- PKCE and strict token-binding are called out to prevent credential replay outside the agent's intended runtime context.
Researchers from AWS and Intuit have designed a zero-trust security framework for the Model Context Protocol (MCP), addressing threats like tool poisoning and unauthorized access through multi-layered defenses including Just-in-Time access control and behavior-based monitoring.
Zero trust is a cybersecurity model that assumes no entity is trustworthy by default, whether inside or outside the network, focusing on continuous verification and least privilege access.
| Tenet | Description |
|---------------------------------|-------------------------------------|
| **Never Trust, Always Verify** | No person or computing entity is inherently trustworthy, regardless of their location inside or outside the network. |
| **Principle of Least Privilege** | Systems and data are locked down by default; access is granted only to the extent necessary to meet defined goals. |
| **Multifactor Authentication** | Requires a credential beyond the password to ensure someone is who they say they are. |
| **Microsegmentation** | Divides the corporate network into smaller zones, each requiring authentication to enter. |
| **Continuous Monitoring** | Constantly monitors network activity, verifies users, and collects information to spot anomalies. |
These tenets form the core principles of a zero trust architecture, which aims to minimize the exposure of sensitive data and applications, and to limit the "blast radius" of a successful cyberattack.
| Tenet | Description |
|---------------------------------|-------------------------------------|
| **Never Trust, Always Verify** | No person or computing entity is inherently trustworthy, regardless of their location inside or outside the network. |
| **Principle of Least Privilege** | Systems and data are locked down by default; access is granted only to the extent necessary to meet defined goals. |
| **Multifactor Authentication** | Requires a credential beyond the password to ensure someone is who they say they are. |
| **Microsegmentation** | Divides the corporate network into smaller zones, each requiring authentication to enter. |
| **Continuous Monitoring** | Constantly monitors network activity, verifies users, and collects information to spot anomalies. |
These tenets form the core principles of a zero trust architecture, which aims to minimize the exposure of sensitive data and applications, and to limit the "blast radius" of a successful cyberattack.
