There has been a lot happening in AI identity recently. Apono was acquired by 1Password, which led to the launch of Credential Broker. WorkOS introduced auth.md. Anthropic published details of how agent identity works in Claude Tag. And Claude Enterprise took on Okta as a featured identity provider. It’s big news and all very positive, clearly pointing towards the industry finally solving the agent identity problem. And that’s great; it really is. But it’s only addressing part of the problem.
There are actually two separate questions here. First, whose identity is it: borrowed from a person, or native to the agent? Second, how scoped is that identity: broad and standing, or narrow and built for one task? Once you separate those two questions, the recent announcements stop looking like one story.
We all know the debate over whether AI agents should have their own identities or borrow a human one. But the other side of that question is how much access an AI identity should have. And that seems to be being ignored in some quarters.
Borrowed identities have always been a problem
If you work in tech, you’ll almost certainly have experienced the problem of borrowed identities. My introduction came while integrating a new platform for a client. Due to the way the platform worked, we had to set up the AI agent to behave as though it were a human user, and it worked brilliantly in browser automation, until a browser extension injected an extra element into the page and broke the flow. Then a password manager displayed a login prompt the automation wasn't expecting. Both times, it stopped.
So we evolved this into a credential broker. The agent never handled the password itself. This helped, improving both security and reliability. But the agent was still pretending to be a person, and that’s the problem that is currently trying to be addressed.
Different approaches to the same challenge
The recent announcements are tackling this issue in different ways.
Okta and 1Password are extending identity infrastructure that was largely designed around people into the world of AI agents. That is an important and practical step. Businesses already have these systems, policies and controls in place, so extending them to agents seems an obvious solution. But it doesn’t move away from the fact that access is still based on a human identity.
WorkOS and Anthropic's Claude Tag are doing something different: giving the agent an identity of its own.
Native identity isn't the end of the problem
The thing that most people seem to be missing is that identity doesn’t solve everything. We also need to think about the scope of what that identity should be allowed to do.
Claude Tag, for example, operates using its own identity and service accounts rather than borrowing individual user credentials. And Anthropic recommends giving Claude broad access within a shared channel so that it can contribute effectively to a team's work. And that makes complete sense because it allows the agent to be more useful. But it also creates greater risk. A lower risk alternative would be to give agents the smallest set of permissions required to complete the job in hand, and potentially create a fresh identity for every new task.
This isn’t a dig at Claude; it’s far from the only platform taking this approach. But really, it doesn’t make sense for us to think about agent identity as a single issue when there are at least three different approaches to take.
First, there’s borrowed identity with broad access, where the agent acts through a human identity and all related authority. Then, there’s native identity with broad access, where the agent has its own identity but retains relatively wide permissions. And lastly, native identity with narrow, task-specific access, which currently seems the best approach, but isn’t without complications.
The accountability problem
The primary issue with the latter two options is accountability. Most established security models make it possible to trace authority back to an identifiable person. So, if an agent is acting on behalf of a named employee, responsibility usually leads back to them. But with native identities, accountability is more of a grey area. In Claude Tag, for example, the identity belongs to the channel rather than to a particular person, so that's where permissions are administered. That makes sense for collaborative teams. But it raises a question: if an autonomous agent makes a bad decision, who is accountable? And that’s something the entire industry needs to address.
If an agent's identity belongs to a channel rather than a person, who do you point at when it breaks? Who owns the decision? Who owns the consequence?
Native identity is an important development, but it doesn’t solve the entire problem. So, these recent announcements are great: useful, informative, potentially long overdue. But there are still many other issues to be addressed, with scope and accountability being the new priorities.
Josh King is the Chief Technology Officer of AI design-and-build studio &above, where he leads the company’s technological vision and innovation strategy. He specialises in deploying AI agents within enterprise environments combining agile, startup-inspired methodologies with deep expertise in solution architecture and implementation.