Notifications
Clear all
Topic starter
20/08/2026 5:26 pm
TL;DR: Agentic authentication for AI, smart devices, and IoT is being addressed with new capabilities in open-source Ory Hydra v25.4.0, including Device Authorization Grant support, OAuth 2.1 discovery, and token chain revocation, according to Ory. The security issue is not the presence of automation but the identity lifecycle assumptions behind long-lived, chained, and delegated tokens.
NHIMG editorial — based on content published by Ory: New Ory Hydra v25.4.0 brings agentic authentication for modern apps and devices
Questions worth separating out
Q: How should IAM teams govern device authorization flows for AI-enabled and constrained devices?
A: Treat device authorization as a delegated NHI flow, not as a human login variant.
Q: Why does token revocation become harder in delegated machine access?
A: Because access is often built from chained credentials rather than a single token.
Q: What should organisations measure to know if non-human authentication is under control?
A: Track whether every non-human flow has a named owner, a defined approval path, a documented expiry, and a tested revocation path.
Practitioner guidance
- Inventory every device and agent flow that uses delegated authentication Identify where device authorization, OAuth discovery, or other delegated flows issue access tokens to smart devices, AI-mediated clients, or constrained workloads.
- Define token revocation chains before you need them Map refresh tokens, access tokens, and derived credentials so security and platform teams know which credentials must be revoked together when a device is lost, an agent is retired, or a linked account is compromised.
- Separate approval context from execution context Treat the approving user, the requesting device, and the downstream service as different trust subjects in policy, logging, and incident response.
What's in the full article
Ory's full post covers the operational detail this post intentionally leaves for the source:
- Implementation context for Hydra v25.4.0's device authorization and OAuth 2.1 discovery support
- The token revocation handling details that matter when one access grant spawns dependent credentials
- How the release is positioned for AI, smart devices, and IoT authentication scenarios
- The product-level release notes and deployment specifics behind the v25.4.0 update
👉 Read Ory's post on Hydra v25.4.0 and agentic authentication →
Agentic authentication in Hydra v25.4.0: are IAM controls ready?
Explore further
20/08/2026 6:15 pm
Agentic authentication is still NHI governance, not a new identity category. The release addresses a familiar problem: non-human actors need bounded access, discoverable endpoints, and revocable credentials. The difference is that the actor is often a device or software-mediated client rather than a classic service account, so token lifecycle discipline matters as much as the login sequence. Practitioners should treat this as an extension of NHI control design, not a separate programme.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: What is the difference between human SSO governance and agentic authentication governance?
A: Human SSO assumes a person completes a session and then uses that session directly. Agentic authentication often involves a device, controller, or software client that exchanges tokens on behalf of something else, so lifecycle, approval context, and revocation scope all need to be modelled explicitly.
👉 Read our full editorial: Agentic authentication in Ory Hydra v25.4.0 for modern devices
