OAuth 2.0 as the foundation for agentic identity at machine speed

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Strata Identity's blog post: OAuth 2.0 is being positioned as the base control plane for agentic identity, with the key finding that existing OAuth capabilities can cover delegation and trust if they are operated at machine speed.

Why it matters: It matters because IAM teams now have to govern AI agents as runtime actors, not just integrate them as another app, and that changes how delegation, revocation, and authorization are designed.

Context

OAuth 2.0 is an authorization framework, not a complete identity programme, but it is increasingly being asked to govern AI agents that act across clouds and APIs. The real gap is not whether OAuth can express delegation, but whether existing controls can keep policy context intact when an agent is making decisions at machine speed.

That shift matters for identity governance because AI agents are no longer passive integrations. They are runtime actors that can request tokens, traverse trust boundaries, and trigger business actions faster than human-centric review, recertification, or incident workflows were designed to handle.

Strata Identity frames the problem as one of operationalising OAuth for agentic identity rather than replacing it. The important question for practitioners is which identity assumptions still hold when the subject is an AI agent with delegated authority, dynamic tool use, and rapid reauthorization needs.

Key questions

Q: What breaks when OAuth scopes are used to authorise agent tool calls?

A: OAuth scopes break down when they are asked to authorise a specific agent action, because scopes do not fully express who is acting, what tool is being called, with which arguments, and in what context. That gap leaves room for the confused deputy problem. Practitioners need a finer-grained decision model for tool invocation.

Q: Why do AI agents need proof-of-possession tokens?

A: AI agents often operate in distributed environments where token theft is a realistic threat. Proof-of-possession binds the token to a cryptographic key, so a stolen token is not enough to impersonate the agent. That materially reduces replay risk when access is delegated across clouds, APIs, and service boundaries.

Q: How do organisations keep delegated access governable when agents act at machine speed?

A: Treat delegation as a live control problem, not a one-time grant. Use inspectable token exchange paths, short-lived credentials, and continuous authorization signals so access can be understood and changed while the agent is still running. If governance only happens after the fact, the control loop is already too slow for agentic execution.

Q: When should teams prioritise CAEP over token expiration for agent access?

A: Prioritise CAEP when access needs to change mid-task, when agents cross trust boundaries, or when risk conditions can shift faster than token lifetimes. Token expiration is still useful, but it is a coarse control. For agentic identity, immediate policy-driven revocation is what keeps access aligned with current context.

Technical breakdown

Delegation chains in OAuth for AI agents

OAuth can represent delegation through on-behalf-of flows and token exchange, which is why it is a credible base for agentic identity. In an agentic setup, the token is not just proof of authentication. It becomes the carrier of delegated authority across services, clouds, and execution hops. The governance problem is traceability: every hop must preserve who initiated the action, what the agent is allowed to do, and under which policy context that delegation remains valid. Without that chain, the agent becomes just another opaque client with broad access.

Practical implication: model every agent flow as a delegation chain, not a standalone session.

Token security at machine speed

The article highlights DPoP, PKCE, and CAEP because agentic identity fails quickly when tokens are reusable, interceptable, or slow to revoke. DPoP binds the token to a key so theft alone is not enough. PKCE removes reliance on long-lived client secrets in dynamic environments. CAEP closes the loop by supporting near-real-time access changes when risk or context shifts. Together, these controls move OAuth from static issuance to runtime enforcement, which is essential when an agent can consume, exchange, and discard credentials faster than a human can observe the session.

Practical implication: require proof-of-possession and rapid revocation for any agent token that crosses trust boundaries.

Attribute-based authorization for agent intent

Scoping alone is too coarse for agentic identity because the same agent may act for different purposes, on behalf of different principals, and under different risk conditions. Attribute-based authorization and custom claims let policy evaluate who the agent represents, what task it is performing, and why access was issued. That matters because agentic access is contextual, not static. The technical challenge is to keep those attributes inspectable enough for policy decisions without turning tokens into opaque blobs that nobody can audit after the fact.

Practical implication: tie policy decisions to task purpose, delegator, and context rather than relying on scope alone.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

OAuth is becoming the control plane for agentic identity, not because it is perfect, but because it already maps to delegated machine action. The article is directionally right to treat OAuth as the practical starting point for AI agents. What changes is that identity governance now has to preserve delegation provenance across actions, tools, and trust domains instead of merely authenticating a client once. Practitioners should treat this as a shift from application login control to runtime authority control.

Task purpose is the named governance gap in agentic OAuth. OAuth scopes were designed to bound actions, but agentic systems require the policy engine to understand why an action is being taken, not just whether a token can take it. That is why the article’s emphasis on attributes and custom claims matters. The implication is that classic scope-only models are too blunt for agentic workflows and will leave either over-permissioned access or unusable friction.

Machine-speed revocation is the operational threshold that distinguishes agentic identity from conventional OAuth deployments. CAEP is not just a feature here, it is evidence that static token lifetime assumptions break when access decisions need to change mid-task. Identity programmes built around periodic review and delayed reauthorization will not keep pace with agent execution. Practitioners should rethink when authority is granted and revoked, not just how it is issued.

Inspectable delegation chains should become a baseline governance expectation for AI agents. If the delegation path is buried inside tokens or middleware and cannot be reconstructed later, accountability collapses when something goes wrong. That problem spans IAM, PAM, and audit teams because the question is no longer only who authenticated, but who authorised the agent to act, on whose behalf, and under which policy state. Practitioners should require auditability at the chain level, not the app level.

OAuth's current shape supports agentic identity, but the standard still lacks first-class semantics for autonomous runtime behaviour. The article correctly identifies the next boundary: multi-agent coordination, explicit task intent, and native inspectability. Those are not cosmetic enhancements. They are the missing governance primitives for environments where identity is not merely reused by software, but actively reasoned over by software at runtime. Practitioners should plan for augmentation, not assume the current model is complete.

From our research library:

• A May 2025 Gartner poll of 147 CIOs and IT leaders found that 24% had already deployed AI agents, 50% were experimenting and 17% planned to deploy by the end of 2026.
• Read next: Agentic AI Identity Guide

What this signals

Machine-speed identity will reshape IAM operating models: access governance for AI agents cannot rely on the same review cadence used for human users or stable service accounts. The control point moves upstream to issuance, delegation, and revocation, because the useful security signal is often the policy state at the moment of action rather than the state at monthly review.

Agentic identity also collapses the separation between authentication and authorization that many programmes still assume. Once an agent can exchange tokens, traverse clouds, and act on delegated authority, the programme has to measure whether those chains remain inspectable and whether revocation is immediate enough to matter.

The practical takeaway for identity teams is straightforward: if an agent can outpace a human approval loop, then the governance model must be built for continuous evaluation. That is the difference between protecting a workload and governing an actor.

For practitioners

• Map agent workflows to delegation chains Inventory every AI agent flow that acts on behalf of a user, service, or another agent, and document the full token exchange path across clouds and APIs.
• Bind high-risk agent tokens to proof-of-possession Use proof-of-possession controls so intercepted tokens cannot be replayed without the private key that issued them.
• Eliminate reliance on long-lived client secrets Prefer secret-free or secret-minimised authentication patterns for AI agents operating in dynamic, distributed environments.
• Require real-time revocation signals Integrate continuous access evaluation so policy changes, risk changes, or task completion can remove access without waiting for token expiry.

Key takeaways

• OAuth 2.0 remains the most practical base for agentic identity because it already expresses delegation, cross-domain trust, and runtime authorization patterns that AI agents need.
• The hardest problem is not authentication, but preserving auditability, intent, and revocation when access is being consumed and exchanged at machine speed.
• Identity teams should shift control emphasis from static token lifetimes to inspectable delegation chains, proof-of-possession, and continuous authorization.

Key terms

• Agentic Identity: An agentic identity is a non-human identity used by an autonomous system that can act, call tools, and access data with execution authority. It needs the same governance discipline as other privileged identities, plus runtime context, ownership mapping, and revocation paths.
• Token Exchange: Token exchange is an OAuth pattern that swaps one credential or token for another with narrower scope or different trust context. In NHI governance, it is useful when a workload must cross boundaries without carrying broad, reusable privileges into downstream systems.
• Proof-of-Possession: Proof-of-possession binds a token or credential to a specific key so possession of the token alone is not enough to use it. For AI agents, it reduces replay risk and helps ensure that an intercepted credential cannot be reused by a different actor.
• Continuous Access Evaluation: Continuous access evaluation is the practice of rechecking whether a principal should still have access after the session begins. In NHI environments, it matters because tokens and service accounts can remain valid while the surrounding risk changes, so enforcement has to follow the request, not just the login.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.