Six vendors ship competing agent identity products ahead of IETF standards
Okta, ServiceNow, and four other vendors have released agent identity tools while the IETF's primary token-exchange draft is set to expire in November.
Timeline
- Okta launched Agent SSO
- Postman released Fabric Gateway
- Cequence launched Agent Trust
- Descope shipped Agentic Identity Hub 3.0
- ServiceNow announced AI Passport
- ID-JAG draft is set to expire
Six major tech vendors, including Okta, Microsoft, and ServiceNow, are shipping competing agent identity products despite the Internet Engineering Task Force (IETF) not yet finishing the necessary industry standards [2].
The lack of a unified standard means enterprises must choose between diverging architectural bets on how AI agents should be identified and authorized. This fragmentation occurs as companies race to secure a growing population of autonomous agents before a consensus protocol is finalized [2].
Tech vendors launch products ahead of standards
Six vendors are currently releasing agent identity products while the IETF standardization process remains incomplete [2]. This gap has created a vacuum that vendors are filling with proprietary or semi-standardized implementations [2].
The divergence in these products reflects a split in the industry over whether agent identity should be anchored to a specific token-exchange standard or a broader governance layer [2]. For many deployers, this means the choice of vendor now dictates the underlying identity architecture [2].
The ID-JAG camp leverages leading draft
One architectural group bases its products on the ID-JAG Internet-Draft, which is currently the industry's closest approximation of a unified token-exchange standard for agent identity [2]. Okta launched Agent SSO on August 24, 2026, using ID-JAG as the scoped token for cross-app authorization [2].
Descope shipped Agentic Identity Hub 3.0 on October 15, 2026, which also utilizes ID-JAG and embeds MCP-native authorization directly into the gateway layer [2]. Descope claims its system has secured millions of agents and over 1,000 protected MCP servers [2].
Despite the adoption by these vendors, the ID-JAG draft is temporary; it is set to expire on November 22, 2026 [2]. This creates a risk for enterprises adopting these tools if the IETF does not formalize the standard [2].
Governance camp builds protocol-agnostic alternatives
A second group of vendors rejects the ID-JAG approach in favor of governance layers that enforce policy regardless of the agent's token format [2]. Postman released Fabric Gateway on September 29, 2026, as a protocol-agnostic layer that governs traffic across HTTP, gRPC, and MCP [2].
ServiceNow announced AI Passport on October 15, 2026, which is scheduled for availability in the fourth quarter of 2026 [2]. Rather than ID-JAG, ServiceNow bases its system on the AIMS and WIMSE specification families and verifies credentials against business context, such as workflow approvals and GRC policies [2].
The push for these alternatives is driven by a projected surge in agent deployment. ServiceNow cites Gartner research predicting that the average Fortune 500 enterprise will manage more than 150,000 agents by 2028 [2]. Cequence also entered this market on October 7, 2026, with the launch of Agent Trust [2].
As forkast.news noted, "The divergence is the story" [2].
What we don't know
- Will the IETF update or formalize the ID-JAG draft before its November 22, 2026 expiration?
- What is the specific behavioral approach used by Cequence's Agent Trust product?
- What are the specific technical implementation details of Microsoft's agent identity product?
