Session 5: Governing AI — Identity Standards & Frameworks for Agentic AI | Non-Human & Agentic AI Identity Summit @ Identiverse 2026
Speakers: Dr Rogério Rondini, Senior Manager, PwC | Rahul Godha, Software Engineer, LinkedIn | Niv Goldenberg, Co-Founder & CPO, Linx Security | David Goldschlag, Co-Founder & CEO, Aembit
In this session from the Non-Human & Agentic AI Identity Summit at Identiverse 2026, identity and security practitioners get into the technical specifics of how AI agents should be identified, authenticated, authorised, and governed — and confront the gap between where the standards are today and where enterprise deployments already are.
Dr Rogério Rondini opens with a story that sets the tone for everything that follows. An organisation proudly deploying 10,000 to 13,000 agents in production was asked how they manage agent lifecycle. Their answer: they don’t. Agents just die. The point isn’t to mock the approach — it’s to show how far behind governance is relative to deployment. IAM was built with humans as the primary actor. AI agents are non-deterministic, interact with APIs and tools, call other agents, and operate at a scale and speed that the existing frameworks were never designed to handle. The foundational questions — how do you identify an agent, how do you establish trust, what authority is it acting under, who is accountable when something goes wrong — don’t yet have standardised answers.
David Goldschlag frames the identity question practically: for agents, identity is in service of access and authorization, not an end in itself. What matters is what the agent can do, what it actually does, and whether there’s an audit trail. His organisation’s job — authenticate the agent, check a policy, issue a credential — sounds simple, but the complexity lies in the policy system that sits above the credential flow. The fact that MCP supports OAuth does not mean you have a policy system that grants rights. Those are separate problems, and the policy system is the harder one.
Niv Goldenberg adds the risk dimension: access matters, but access that isn’t risky can wait. The priority is modelling the complexity of agent interactions — understanding attribution, establishing who an agent is acting on behalf of, and determining who has the authority to approve or deny actions that are happening faster than any human review cycle can accommodate.
Rahul Godha provides the practitioner’s definition of what first-class agent identity looks like: a distinct identity for the agent itself, separate from the platform hosting it and the user who triggered it, registered in a centralised location, with the ability to prove who did what, on whose behalf, with what permissions, at any point in time. On the standards question, he walks through the current landscape clearly. MCP has become the de facto enterprise standard for tool calls and agent-to-agent communication not because it was ready — it wasn’t — but because the market adopted it before security caught up. The recent addition of OAuth-based authorization is a step forward, but MCP is not yet enterprise-grade. The IETF draft on agentic identity and access management provides a more rigorous foundation covering credential management, authentication, authorization, and how tokens flow through delegation chains. The practical advice: understand your use case first, then identify which emerging standards address it, rather than trying to implement everything at once.
The session gets most specific on multi-hop delegation — the scenario where an agent calls a sub-agent, which calls another, and the chain of custody for the original user’s intent gets progressively harder to maintain. David Goldschlag introduces the token exchange model as the practical architectural answer: rather than passing a single credential across the entire chain, each hop gets credentials only sufficient to reach the next step. No agent should be able to mint its own credentials, and no agent should impersonate the user — delegation, not impersonation, is the correct model. But the panel pushes back on the assumption that delegation always means narrower rights: an agent may be entitled to rights that don’t derive from the delegating user at all, which means the permission calculation at each hop is more complex than a simple subset relationship.
Niv Goldenberg connects this back to intent: the ability to capture, pass through, and enforce intent across a delegation chain is what makes scoped, time-bounded, purpose-specific access possible. Without it, you’re either over-privileging agents or constantly breaking workflows. He also identifies where the current open standards are most clearly failing: none of them adequately address permissioning and scoping at the point of agent registration, which means organisations are left to design their own controls for one of the most critical moments in the agent lifecycle.
The session closes on the architecture question. Policy enforcement for agents is not a single layer — it is a combination of controls at the endpoint, the network, the gateway, and the workload. The trend is toward managed cloud environments for agent execution, where organisations can enforce consistent policy across all dimensions rather than trying to govern distributed endpoint-based agent runs. Cross-domain policy orchestration is coming. Zero trust for agents — authenticate the agent, understand its risk posture, filter data accordingly — is the framework within which the rest of these controls sit.
