Agent identity standards are being written right now, across several bodies at once. Protocols for connecting agents to tools and to each other, OAuth extensions for delegation, workload identity for agents, authorisation APIs, agent authentication for payments, and government guidance are all moving in parallel. Some are published and stable; many are drafts that will change. This tracker summarises where the main standards and initiatives stand, what each means for identity and security teams, and what to watch next. We review it regularly; always check the linked primary source before relying on a specific requirement.
Last reviewed: 26 September 2026
Key takeaways
- The direction of travel is clear: build agent identity on existing standards (OAuth, OpenID, workload identity and SPIFFE) rather than inventing a separate identity system for agents.
- Stable enough to use now: core OAuth RFCs (token exchange, resource indicators, protected resource metadata, DPoP, mTLS), the MCP authorisation specification, SPIFFE, OpenID AuthZEN Authorization API 1.0, and the OWASP NHI and Agentic Top 10 lists.
- Still moving: multi-hop delegation, agent-specific workload identity drafts, agent registries and discovery, agent authentication for payments, and NIST agent identity guidance.
- Design for change: prefer products and architectures that follow open standards and can adopt new revisions without re-engineering.
Status key
- Published: final standard, RFC or specification revision.
- Draft: working draft or Internet-Draft; expect changes.
- Initiative: programme, working group or community group without a finished specification.
- Guidance: framework or list intended to inform practice rather than define a protocol.
Agent protocols
| Standard | Body | Status | Identity and security relevance |
|---|
| Model Context Protocol (MCP) | Agentic AI Foundation (Linux Foundation); created by Anthropic | Published; date-versioned revisions (current revision dated 28 July 2026) | Authorisation for HTTP servers builds on OAuth 2.1: Protected Resource Metadata (RFC 9728), resource indicators (RFC 8707), audience validation, no token passthrough, Client ID Metadata Documents (Dynamic Client Registration now deprecated). Authorisation is optional; local servers use environment credentials. See the MCP Security Guide. |
| Agent2Agent (A2A) | Linux Foundation; contributed by Google | Published; version 1.0 reported in March 2026 | Agent discovery via Agent Cards; declared authentication schemes; signed Agent Cards using JWS and JSON canonicalisation. Leaves authorisation decisions to implementers. See the Multi-Agent and A2A Security Guide. |
| Agentic AI Foundation (AAIF) | Linux Foundation | Initiative; formed December 2025 | Neutral home for MCP, goose and AGENTS.md. Platinum members include major model and cloud providers. Watch for security and identity work across its projects. |
OAuth and IETF
| Standard | Status | Relevance to agents |
|---|
| RFC 8693 OAuth 2.0 Token Exchange | Published | Per-hop token exchange and the act claim for recording who acts on whose behalf; the basis of most agent delegation patterns today. |
| RFC 8707 Resource Indicators and RFC 9728 Protected Resource Metadata | Published | Audience-bound tokens and resource discovery; both required by the MCP authorisation specification. |
| RFC 9449 DPoP and RFC 8705 OAuth mTLS | Published | Sender-constrained tokens so stolen agent tokens cannot be replayed. |
| RFC 9396 Rich Authorization Requests | Published | Fine-grained, task-specific authorisation details instead of broad scopes. |
| RFC 9700 OAuth 2.0 Security Best Current Practice | Published | Baseline security requirements for any OAuth deployment involving agents. |
| OAuth 2.1 | Draft | Consolidates OAuth 2.0 with current security practice; referenced by MCP. |
| OAuth Client ID Metadata Document | Draft | Lets a client use an HTTPS URL as its client ID; recommended by MCP for client registration. |
| OAuth Working Group drafts on transaction tokens and cross-domain identity chaining | Draft | Carrying identity and context through chains of internal services and across trust domains; relevant to multi-hop agent delegation. Check the OAuth WG documents for current status. |
| WIMSE working group (Workload Identity in Multi System Environments) | Draft (architecture and related drafts) | Workload identity across systems. Individual drafts submitted to the group explore applying workload identity to AI agents; some have expired or been superseded, so check datatracker for the latest. |
OpenID Foundation
| Standard | Status | Relevance to agents |
|---|
| AuthZEN Authorization API 1.0 | Published (Final Specification, January 2026) | Standard interface between policy enforcement and decision points; the working group has published further drafts aimed at agent use cases. See the AI Agent Authorisation Guide. |
| AI Identity Management Community Group | Initiative | Landscape work on agent identity, delegation, discovery and governance; informs future OpenID and liaison standards. |
| CIBA Core 1.0 | Published | Out-of-band user approval, usable for human approval of high-risk agent actions. |
| Shared Signals Framework, CAEP and RISC | CAEP and RISC: Final (September 2025); SSF: Implementer's Draft | Pushing revocation and risk events between services, supporting fast agent containment. |
Workload identity
| Standard | Status | Relevance to agents |
|---|
| SPIFFE and SPIRE | Published (Cloud Native Computing Foundation project) | Attested, short-lived workload identities usable as the foundation for agent identity. See our guide to SPIFFE and SPIRE. |
| Cloud workload identity federation | Vendor implementations | Keyless authentication for agents running in cloud and CI/CD. See the Cloud Workload Identity Guide. |
Agent authentication and commerce
| Standard or initiative | Status | Relevance |
|---|
| FIDO Alliance agentic working groups | Initiative (announced 28 April 2026) | Agentic Authentication and Payments technical working groups defining how agents authenticate users, verify intent and transact. |
| Agent Payments Protocol (AP2) | Draft (v0.2); contributed by Google to the FIDO Alliance in April 2026 | Verifiable mandates recording what a user authorised an agent to buy, including "human not present" purchases. |
| Verifiable Intent | Contributed by Mastercard to the FIDO Alliance | Tamper-evident record of user-authorised agent actions. |
| Agentic Commerce Protocol (ACP), Universal Commerce Protocol (UCP), Visa Trusted Agent Protocol, Mastercard Agent Pay | Industry specifications and programmes (2025 to 2026) | Checkout and payment flows for agents, and network-level agent identification and tokenisation. Relevant where agents buy on behalf of users or customers. |
| W3C Agent Identity Registry Protocol Community Group | Initiative (April 2026) | Verifiable agent identity binding agents to controlling organisations for cross-organisation trust. |
Government guidance and regulation
| Item | Status | Relevance |
|---|
| NIST NCCoE: Software and AI Agent Identity and Authorization | Initiative (concept paper February 2026; comments closed April 2026) | Proposed demonstration applying existing identity standards to enterprise agents: identification, authentication, authorisation, delegation, auditing and prompt injection controls. |
| NIST CAISI AI Agent Standards Initiative | Initiative (launched February 2026) | US government programme on standards for AI agents. |
| NIST IR 8596 Cyber AI Profile | Draft (preliminary draft December 2025) | Maps AI considerations onto the Cybersecurity Framework 2.0. NIST is also developing SP 800-53 control overlays for securing AI systems. |
| NIST AI RMF 1.0 and AI 600-1 Generative AI Profile | Published | Voluntary AI risk management framework. |
| EU AI Act, as amended by the Digital Omnibus on AI | Law; staged application | Transparency obligations from 2 August 2026; high-risk obligations from 2 December 2027 (Annex III) and 2 August 2028 (Annex I). See the Agentic AI Compliance Guide. |
| ISO/IEC 42001:2023 | Published | Certifiable AI management system standard. |
Security guidance
What to watch next
- Multi-hop delegation: whether OAuth drafts on transaction tokens and identity chaining, and agent-focused AuthZEN work, converge on a common way to carry "user, via agent A, via agent B".
- Agent identity in WIMSE: whether an agent-specific profile of workload identity is adopted by the working group.
- MCP revisions: further hardening of authorisation, including a planned move to require issuer identification in authorisation responses, and security features in extensions.
- Agent registries and discovery: signed agent metadata and registry work across A2A, W3C and industry groups.
- NIST NCCoE project: a draft project description and practice guide following the concept paper.
- EU AI Act implementation: harmonised standards and Commission guidance ahead of the high-risk dates.
- FIDO agentic working groups: first draft specifications for agent authentication and payment intent.
How to use this tracker
- Build on published standards now; they are unlikely to change materially.
- Prototype with drafts but isolate them behind interfaces you can update.
- Ask vendors which of their features depend on drafts, and how they will follow changes. See the AI Agent Identity Security Buyer's Guide.
- Re-check the primary sources before audits, RFPs and architecture decisions.
Status information is based on the linked primary sources and public announcements as at the review date, and may have changed since. Related NHI Mgmt Group resources: Agentic AI Identity Guide · NHI Authentication Guide · Agentic AI Security Guide
NHIMG Editorial Note
Written and reviewed by Lalit Choda, NHI Mgmt Group. Last updated 26 September 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security.
nhimg.org
