Enterprise-managed authorization changes the identity model for AI agents

At a glance

What this is: This is an analysis of MCP Enterprise-Managed Authorization and its key finding: authorization is shifting from human-centric consent flows toward policy-driven identity for autonomous agents.

Why it matters: IAM, PAM, and NHI teams need to understand that the same authorization plumbing that removes user friction can also formalise agent identity, lifecycle, and revocation across human and machine programmes.

By the numbers:

• 27 days
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes - and as quickly as 9 minutes in some cases.

👉 Read Newcore's analysis of enterprise-managed authorization for MCP and AI agents

Context

Enterprise-managed authorization for MCP changes the control point for access. Instead of every new connector relying on a human consent loop, the identity provider becomes the policy authority that decides what can connect, under which assurance level, and for how long. That matters because MCP is increasingly being used as the access layer for AI agents, not just for interactive users typing into Claude Code.

The governance gap is straightforward: human-paced consent models do not describe autonomous work that runs without a person present. Once an agent is allowed to request tokens mid-task, receive scoped access from the IdP, and continue operating without a browser step, identity management has to cover the agent itself, not only the human behind it. That is the real implication for NHI and IAM programmes.

The article's starting point is typical for the market. Most coverage still centres on zero-touch login for people, even though the underlying protocol can support governed agent identity across trust domains.

Key questions

Q: How should security teams govern AI agents that use service accounts and MCP tools?

A: Start with ownership, then add runtime attribution and containment. Security teams should know which human deployed the agent, which identity the agent uses, what tools it can invoke, and when to revoke access. If the agent can chain tool calls or spawn sub-agents, governance must cover those paths as well, not just the initial login.

Q: Why do autonomous agents break traditional consent-based access models?

A: Because consent models assume a person is present to approve access and understand the scope of the request. Autonomous agents can request, chain, and use access during unattended execution, so a browser prompt no longer represents the real control point. Governance has to move to policy, lifecycle, and audit at the identity provider.

Q: How can organizations effectively manage access delegation for AI agents?

A: Organizations can manage access delegation for AI agents by implementing policy-based authorization frameworks that ensure correct access levels are maintained. This also involves continuously monitoring agent activities to prevent overprivileged actions.

Q: Who should own revocation when an AI agent goes off task?

A: Revocation should sit with the same governance function that owns other privileged identities, because an off-task agent is still an access problem, not just an application defect. The right owner can disable the identity, remove entitlements, and review the approval path that created the risk. Shared ownership usually leaves the agent active for too long.

Technical breakdown

How EMA shifts MCP authorisation from consent to policy

Enterprise-Managed Authorization replaces repeated resource-server consent screens with an identity-provider-mediated grant flow. In practice, the client receives an Identity Assertion JWT Authorization Grant through OAuth token exchange, and the IdP evaluates group, role, and conditional access policy before minting a scoped token. This makes the IdP the authoritative control plane for MCP access, rather than the individual connector. That architecture reduces friction, but it also centralises trust and makes scope narrowing, revocation, and audit all depend on the IdP path.

Practical implication: treat the IdP policy layer as part of the application authorization boundary, not as a login convenience.

Why autonomous agents need a subject identity, not just delegated access

Delegated access works when an agent is acting inside a human session, but it breaks down when the workload is long-running, unattended, or multi-hour. In those cases, the agent cannot accurately be described as a client borrowing a human identity, because the human may not be present when the token is minted or used. A subject identity for the agent allows lifecycle ownership, independent revocation, and audit that names the actual actor. That is the difference between a workflow assistant and a governed non-human principal.

Practical implication: separate interactive, on-behalf-of use cases from autonomous agent use cases before you design identity and token policy.

Why short-lived, sender-constrained tokens matter more in agentic workflows

EMA becomes materially safer when the resulting grants are short-lived and sender-constrained. Short lifetimes limit how long a stolen token remains useful, while DPoP or cnf binding ties the token to a key the agent controls. Rich Authorization Requests add task-scoped structure, so the grant reflects a specific action rather than a standing entitlement. That combination matters because agentic systems can request new access mid-task and resume without a human checkpoint. The security model therefore has to assume machine-speed reuse, not human review cadence.

Practical implication: require proof-of-possession and task-scoped authorisation for any autonomous agent that can reach external tools or data.

Threat narrative

Attacker objective: The objective is to turn governed authorization into a scalable path for expanding tool access and identity reach across MCP-connected systems.

1. Entry occurs when a user or autonomous client obtains access through the governed MCP authorization flow rather than a separate consent screen.
2. Escalation occurs when the same policy channel is used to mint additional scoped grants mid-task, allowing the actor to expand reachable tools without human intervention.
3. Impact follows when the agent continues operating with policy-approved access across connected servers, making the real risk unauthorized reach, not just login compromise.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Policy-driven consent is no longer just a human UX improvement, it is the control plane for machine identity. EMA removes the browser-mediated decision point and puts authorization inside the IdP, which is exactly where NHI governance has always wanted access decisions to live. That shifts the discussion from convenient login to authoritative lifecycle control, because revocation, audit, and scope now depend on one central policy layer. Practitioners should recognise that this is not a UI change; it is an identity architecture change.

Access review processes assume access persists long enough to be reviewed; autonomous agents can acquire and release privileges inside a single session. That assumption was designed for human users and many service accounts, where entitlement windows are measurable across days or weeks. It fails when the actor is autonomous because token issuance, tool selection, and execution timing can all happen without human pace. The implication is that review cadences alone cannot describe agent authority.

Agent as subject is the named concept that matters here: a non-human principal with its own lifecycle, credentials, and audit trail. The article is right to show why the synthetic employee model is not a theoretical edge case but an operational identity type. Once an agent needs its own subject identity, identity teams have to govern it like a first-class principal across trust domains, not as a shadow of the human who triggered it. Practitioners should design for agent subjecthood, not merely agent delegation.

Cross-domain authorization is where many current agent controls become structurally incomplete. Within a single tenant, vendors can already govern autonomous or semi-autonomous agents, but the hard problem is carrying that identity across different resource servers and trust boundaries. That is where identity, access, and lifecycle governance converge, and it is where NHI controls must be extended rather than copied from human IAM. Practitioners should assume the multi-domain case will be the governance test that matters most.

The category is moving from secret-based access to policy-backed identity, but policy without actor classification is still incomplete. An IdP can issue a grant, but the governance model still has to distinguish between human subject, delegated agent, and autonomous subject. Without that distinction, least privilege gets defined too broadly and accountability gets assigned too vaguely. Practitioners should classify the actor before they classify the access.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
• That gap becomes more consequential when agentic systems rely on the same secret handling patterns, as explored in LLMjacking: How Attackers Hijack AI Using Compromised NHIs.

What this signals

Agent subject identity is moving from experiment to operational requirement. Teams that currently treat AI access as a wrapper around human identity will need a separate principal model once agents run unattended, cross trust domains, and require independent revocation. This is where policy, lifecycle, and audit stop being account administration and become identity architecture.

With 43% of security professionals already concerned that AI systems may learn and reproduce sensitive information patterns from codebases, the practical risk is not just access sprawl but policy leakage through the systems themselves. That makes the combination of token binding, scoped grants, and inventory even more important for programmes that want to govern both NHI and agentic AI without overextending human IAM controls.

The immediate programme signal is that authorization and lifecycle must be designed together. If you can issue a grant to an agent but cannot classify, review, and revoke that agent as a standalone principal, then the control plane is incomplete.

For practitioners

• Classify every MCP connector by actor type Separate interactive human-on-behalf-of workflows from autonomous agent workflows before assigning authorization policy. Use one policy pattern for delegated use and a different one for agent subject identity, because the lifecycle and accountability model are not the same.
• Bind agent tokens to proof-of-possession Require sender-constrained tokens for any agent that can reach sensitive tools or data. Token binding reduces the value of theft and makes the private key part of the control boundary rather than the access token alone.
• Shorten token lifetime to match machine-speed use Use short-lived grants and re-request flows so access dies quickly when policy changes or the agent is decommissioned. Minutes matter more than hours when the actor can continue operating without waiting for a person to intervene.
• Inventory autonomous subjects separately from human users Create a directory view that records agent lifecycle, sponsor, policy scope, and trust-domain reach. A synthetic employee should be discoverable as its own principal, not hidden inside a human account or app registration.

Key takeaways

• EMA shifts MCP from user-centred consent toward IdP-centred policy, which is a material change for NHI and agent governance.
• The article's key insight is that autonomous agents need a subject identity of their own, not only delegated access through a human session.
• Practitioners should align authorisation, token binding, lifecycle ownership, and revocation around the agent principal before the model scales further.

Key terms

• Enterprise-Managed Authorization: Enterprise-managed authorization is a policy model in which the identity provider decides what an agent may do and encodes that decision into the token or access flow. It helps organisations keep control logic centralized instead of spreading entitlement decisions across many servers.
• Identity Assertion Authorization Grant: An OAuth extension that lets an identity provider issue a signed, short-lived assertion saying a specific client may act for a specific user at a specific downstream app. It shifts approval from the target tool to the enterprise identity plane, which is what makes cross-app delegation governable at scale.
• Agent subject identity: A non-human principal that exists in the directory under its own identity, lifecycle, and audit trail. For autonomous systems, this is the governance model that allows independent revocation, clear attribution, and least privilege without pretending the human operator is always the real actor.
• Sender-constrained token: A sender-constrained token is tied to a specific client or cryptographic proof, rather than being usable by anyone who steals it. This reduces replay risk and is especially important where tokens can reach automation, services, or agents with broad API access.

What's in the full article

Newcore's full blog covers the operational detail this post intentionally leaves for the source:

• The exact ID-JAG and token-exchange flow used to move from human login to MCP authorisation.
• The three identity models for agents, including delegated client, named actor, and agent as its own subject.
• Implementation details for confidential clients, DPoP-bound tokens, and task-scoped RAR authorisation.
• Examples of how the same mechanism behaves across Anthropic, Okta, Microsoft, and other early implementations.

👉 The full Newcore post explains the identity models, token mechanics, and cross-domain governance trade-offs.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.