Notifications
Clear all
Topic starter
20/08/2026 5:23 pm
TL;DR: When AI agents generate millions of auth requests per second, traditional identity infrastructure breaks, according to Ory's analysis with Cockroach Labs. The real issue is not raw throughput alone but whether identity controls can preserve trust, authorization, and service reliability under agentic scale.
NHIMG editorial — based on content published by Ory: The next scale frontier: How Ory and Cockroach Labs are rebuilding trust for agentic AI
Questions worth separating out
Q: How should security teams govern AI agents that generate very high auth volume?
A: Treat AI-agent authentication as a production identity workload, not a special case.
Q: Why do AI agents stress identity infrastructure more than normal automation?
A: Because they can create continuous, machine-paced access demand that exceeds the assumptions built into most IAM systems.
Q: What should teams monitor to know if agentic identity controls are failing?
A: Watch authorization latency, token churn, policy cache dependence, and any increase in fail-open behaviour.
Practitioner guidance
- Load-test identity services with agentic traffic patterns Simulate sustained bursts of authentication, token minting, and authorization checks that resemble AI-agent behaviour, not user login flows.
- Separate dynamic tool access from baseline agent authentication Define distinct controls for initial agent identity proofing, tool-level authorization, and cross-system delegation so that one overloaded path does not flatten all trust decisions into a single gate.
- Set explicit latency budgets for authorization decisions Treat policy lookup time, token issuance time, and revocation propagation as operational thresholds.
What's in the full article
Ory's full post covers the operational detail this analysis intentionally leaves for the source:
- The specific scaling architecture used to support very high agent-authentication throughput.
- The practical trust model for splitting identity, authorization, and data-plane responsibilities.
- The implementation details behind agent-oriented identity patterns across Ory and Cockroach Labs.
- The deployment trade-offs practitioners need to understand when moving from concept to production.
👉 Read Ory's analysis of agentic AI scale and identity infrastructure →
Agentic AI auth scale: what identity teams need to rethink?
Explore further
20/08/2026 6:13 pm
Agentic auth scale exposes a trust assumption that most IAM stacks still depend on: access requests are expected to arrive at human or bounded automation rates. When AI agents can generate millions of requests per second, that assumption no longer holds. The implication is that identity teams must treat runtime demand as part of the security model, not just the capacity plan.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that weakens centralised lifecycle control.
A question worth separating out:
Q: When does MCP provide a better governance model than CLI for AI agents?
A: MCP is the better governance model when an agent needs delegated access, structured audit data, and centrally enforced policy across multiple systems or users. At that point, the problem is no longer command execution. It is identity, scope, and accountability at runtime.
👉 Read our full editorial: Agentic AI auth scale is breaking traditional identity infrastructure
