Agent identity, not an AI gateway, is the first security control an organisation should build before it lets AI agents touch production systems. That is the argument at the centre of a pair of guest essays VentureBeat published on 30 August 2026, one headlined “AI agents need their own identity before they need a gateway”, the other warning that agents which pass authentication “can still drift, expose data, or get memory-poisoned”. Between them, the two pieces make a sequencing case that runs against how most enterprises are actually deploying AI agents.
The case is simple to state. A gateway is a proxy that sits in front of model and tool calls, enforcing policy, rate limits and logging. It is the control security teams reach for first, because it is the one they know how to buy. But a gateway can only act on what it can see, and the thing it most needs to see — which agent is acting, on whose authority, for what task, with which credential — is exactly the agent identity layer that most organisations have not built. Without it, the gateway is enforcing rules against requests it cannot attribute.
This article explains what the essays argue and why the timing matters, walks through the six-gate deployment model one of them proposes, sets the argument against the survey numbers on machine identity, summarises what Okta, Microsoft, Cloudflare, Kong, the IETF and NIST have shipped on agent identity this year, and closes with a 30-day plan a UK business can run without buying anything. Every figure is traceable to a link in the References section.
Table of contents
- What the VentureBeat Essays Argue About Agent Identity
- Why a Gateway Cannot Substitute for Agent Identity
- The Six Gates: Where Agent Identity Sits in Dependency-Gated Deployment
- The Numbers Behind the Agent Identity Gap
- What Vendors and Standards Bodies Have Shipped for Agent Identity
- A 30-Day Agent Identity Plan for a UK Business
- The Limits of the Argument
- Agent Identity FAQs
- References and Further Reading
What the VentureBeat Essays Argue About Agent Identity
The two essays approach the same problem from different ends. One starts from the gateway and works backwards to identity; the other starts from authentication and works forwards to runtime behaviour. Read together, they describe an agent identity gap that opens the moment an organisation stops treating an agent as a feature of an application and starts treating it as an actor in its own right.
The gateway is the first control, and the least ready
The sequencing essay opens with a blunt observation: “The gateway is the first control teams reach for, but it is the one they are least ready to run.” Gateways, it argues, “sit on top of identity and attribution layers that are mostly not there.” Buying a proxy before establishing agent identity is like installing a turnstile before issuing anyone a pass — the turnstile works, but it cannot tell who is walking through, and it will let a valid pass through no matter who is holding it.
The borrowed-token problem
The worked example is a finance-reconciliation agent that tries to alter a production record using a token borrowed from the human who launched it. In the essay’s words: “The credential is valid. The API call is permissible. The action contradicts the purpose of the delegation.” Nothing in a conventional gateway can flag that request, because the request looks exactly like the human making it. Only a distinct agent identity, carrying the context of what it was delegated to do, gives the enforcement point anything to reason about.
Authentication is not runtime trust
The companion essay, written by a cybersecurity architect, adds the second half of the picture. Authentication answers “who are you”; it does not tell you whether an authenticated agent keeps behaving safely once it is inside. The essay names five runtime threats and proposes a “runtime trust” model — intent validation, behavioural monitoring, policy enforcement, short-lived least-privilege permissions and human oversight of high-impact actions — that presupposes a working agent identity to attach any of those controls to.
| Runtime threat named in the essay | What it looks like in practice | Why agent identity is the prerequisite control |
|---|---|---|
| Goal drift | The agent pursues an objective that has quietly moved away from its brief | Drift is only detectable against a stated purpose tied to the agent identity |
| Excessive tool invocation | Far more API and tool calls than the task needs | A behavioural baseline needs a stable identity to baseline |
| Memory poisoning | Untrusted content written into persistent memory or a RAG store | Attribution shows which actor wrote what, and when |
| Context manipulation (MITRE ATLAS) | Injected instructions steer the agent through its inputs | Task-scoped credentials limit what a hijacked agent can reach |
| Multi-agent amplification | One compromised agent instructs others | Delegation chains are invisible without per-agent identity |
Why a Gateway Cannot Substitute for Agent Identity
It would be easy to read the essays as anti-gateway. They are not. The sequencing essay is explicit that a gateway is where runtime enforcement eventually lives, checking “this agent, for this principal, within this task, on this resource” at the most irreversible boundaries — payments, policy changes, deletions, production changes and exports. The objection is to order, not to the tool: “Gateway controls should not be the first control. They should be the fifth.”
A proxy enforces what it can see
A gateway sees a request, a credential and a destination. It does not see that the request was agent-initiated, that the agent’s purpose was narrower than the human’s, or that the action was triggered by an untrusted artifact. Those three facts are all properties of agent identity and delegation context, and none of them travels inside a borrowed bearer token. The proxy can rate-limit, log and block by pattern, but it cannot answer the question that matters most after an incident: which agent did this, and on whose authority?
The gateway is itself an attack surface
The essay’s second point is that the gateway is not a neutral piece of plumbing. It cites the June 2026 LiteLLM incident, in which CVE-2026-42271 — a remote code execution flaw in the open-source LLM gateway — was added to the CISA Known Exploited Vulnerabilities catalogue on 8 June 2026, with a federal remediation deadline of 22 June. Affected versions ran from 1.74.2 to 1.83.6, and the author counts seven CVEs in that one product in a single month, one of which chained without any credentials. A control that concentrates every model and tool call is a control that concentrates every attacker’s interest.
Twenty agents, one person’s permissions
The most quotable line in the essay is also its most practical: “Twenty agents might operate under a single person’s permissions and still need unique identities, audit logs, behavior profiles, and revocation paths.” Limiting each agent to its human owner’s privileges feels like least privilege, but it collapses twenty distinct actors into one log line. When one of them misbehaves, the only revocation available is to cut off the human — which cuts off the other nineteen too. Per-agent identity is what makes revocation surgical rather than total.
| Question an investigator asks | Gateway alone | Gateway plus agent identity |
|---|---|---|
| Which agent made this call? | The human’s account | The named agent, its owner and its lifecycle state |
| On whose authority, for what task? | Unknown | Delegating principal and task id in the token |
| Was this within the delegated purpose? | Cannot be evaluated | Checked against task scope at the enforcement point |
| Can we stop just this agent? | Only by disabling the human | Disable the agent identity, revoke derived credentials |
| What else did it touch? | Everything the human touched that day | Every call linked to agent, task and parent action |
| Did it hand work to another agent? | Invisible | Recorded as a delegation with shrinking scope |
The Six Gates: Where Agent Identity Sits in Dependency-Gated Deployment
The constructive heart of the sequencing essay is a model it calls dependency-gated deployment: six controls that must be passed in order, each depending on the one before. Agent identity is the second gate, and the gateway does not appear until the fifth. The model’s appeal is that it does not require a new identity programme; it reuses workload identity, token exchange, conditional access and time-bound entitlements most organisations already own.
| Gate | Control | What it must record or enforce | Depends on |
|---|---|---|---|
| 1 | Agent inventory | Named owner, purpose, approved tools, lifecycle state | Nothing — this is the start |
| 2 | Agent identity and delegation context | Which actor called, whose authority, and why | Inventory |
| 3 | Task-scoped, short-lived credentials | Monotonic delegation: authority can only shrink on hand-off | Agent identity |
| 4 | Attributable telemetry | Every tool call linked to agent, principal, task id, parent action, outcome | Credentials |
| 5 | Runtime enforcement (the gateway) | This agent, for this principal, within this task, on this resource | Telemetry |
| 6 | Baselines and kill path | Disable identity, revoke credentials, block tools, kill tasks, isolate workload | Enforcement |
Gates one and two: inventory and identity
Gate one is an authoritative agent registry — every production agent with a named owner, a stated purpose, an approved tool list and a lifecycle state. Gate two gives each entry a distinct agent identity plus delegation context. The essay draws the distinction precisely: identity says which actor made the call; delegation says whose authority it acted under and why. Both are needed, and neither is provided by an application service account shared across a team.
Gates three and four: credentials and telemetry
Gate three turns that agent identity into task-scoped, short-lived credentials, built by exchanging the delegating principal’s token for one that carries the agent’s narrower scope. The rule the essay calls monotonic delegation is the key design constraint: on every hand-off, authority can only shrink, never grow. Gate four is attributable telemetry, which the author calls “the most commonly missed gate” — logs that link every tool call to the agent, the principal, the task id, the parent action and the outcome, so that a completed task can be reconstructed end to end.
Gates five and six: enforcement and the kill path
Only at gate five does the gateway earn its place, because only now does it have identity, scope and telemetry to enforce against. Gate six adds behavioural baselines per agent identity and a cross-system kill path: disable the identity, revoke every credential derived from it, block its tools, kill its running tasks and isolate the workload. The reason that path is cross-system is the same reason the borrowed token was dangerous — an agent’s blast radius spans every system it was delegated into, and so must its off switch.
The Numbers Behind the Agent Identity Gap
The essays make an argument, not a survey. But the survey data published in 2026 supports their premise that the agent identity layer is missing in most organisations, and that machine identities are already the majority of what an identity system manages.
Machine identities outnumber humans 109 to 1
Palo Alto Networks’ 2026 Identity Security Landscape report, drawn from 2,930 security leaders, put the ratio of machine identities to human identities at 109 to 1, up from 82 to 1 a year earlier. Nine in ten organisations reported a successful identity-related breach in the previous twelve months, and respondents expected the number of AI-agent identities to grow by 85% within a year. Only 37% said they could revoke an agent’s credentials, and only 30% kept immutable audit logs for agents — gates six and four of the model above, missing in most estates.
Setting the current 109-to-1 ratio as the full bar, the year-earlier 82-to-1 figure is 82 divided by 109, or 75%.
Most organisations cannot tell an agent from a person
A Cloud Security Alliance survey with Aembit, published in March 2026 from 228 respondents, found that 68% of organisations cannot clearly distinguish AI-agent activity from human activity — which is the borrowed-token problem measured. In the same survey, 74% said agents receive more access than they need, 43% rely on shared service accounts for agents, and 31% let agents run under a human’s identity. A second CSA survey with Token Security a month later, from 418 respondents, found 82% had unknown agents in their environment and 65% had suffered an agent-related incident in the previous twelve months.
Each bar below is the percentage itself, so 68% fills 68% of the track.
Over-privilege is where the incidents come from
The essays’ own sources point the same way. Teleport’s 2026 State of AI in Enterprise Infrastructure Security report, from 205 CISOs and platform leaders, found a 76% incident rate among organisations running over-privileged AI, against 17% under least privilege — a 4.5-fold difference. Okta’s AI Agents at Work 2026 study of 292 executives and 492 knowledge workers found only 34% apply the same security controls to agents as to humans, while 58% had already experienced an AI-related incident or near miss — and 96% of executives were nonetheless confident their identity systems secured non-human identities.
Setting the 76% over-privileged incident rate as the full bar, the 17% least-privilege rate is 17 divided by 76, or 22%.
What Vendors and Standards Bodies Have Shipped for Agent Identity
The essays land in a year when the agent identity market has moved quickly. The pattern across vendors is telling: the identity providers are extending human identity to agents, and the gateway vendors are bolting identity on — which is the essays’ sequencing argument playing out in product roadmaps.
| Who | What shipped | When | Which gate it serves |
|---|---|---|---|
| Okta | Agent SSO with Cross App Access, an OAuth extension adopted as MCP’s Enterprise-Managed Authorization extension | 24 Aug 2026 | 2 and 3 |
| Microsoft | Entra Agent ID generally available: agent identity blueprints, owners and sponsors, Conditional Access templates for autonomous and on-behalf-of agents | Spring 2026 | 1, 2 and 3 |
| Cloudflare | Identity-aware AI Gateway open beta, attaching the Access user id to every request with per-user spend limits and anomaly detection | 5 Aug 2026 | 4 and 5 |
| Kong | Kong Agent Gateway for LLM, MCP and A2A traffic, verifying identity for every agent | 14 Apr 2026 | 5 |
| IETF | draft-klrc-aiagent-auth-03 from engineers at Defakto, AWS, Zscaler, Ping, OpenAI and Okta: WIMSE/SPIFFE identifiers plus OAuth delegation | 6 Jul 2026 | 2 and 3 |
| NIST NCCoE | Concept paper on accelerating adoption of software and AI agent identity and authorisation | 5 Feb 2026 | 1 to 4 |
The identity providers
Okta’s Agent SSO, announced on 24 August 2026, folds Cross App Access — the OAuth extension it introduced in June 2025 — into its core single sign-on product at no extra charge, with Anthropic, Atlassian, Slack, Notion and Datadog among the partners. The same extension underpins the enterprise-managed authorisation feature we covered when Anthropic made it generally available for Claude MCP connectors. Microsoft’s Entra Agent ID, now generally available, gives every agent a first-class directory object with an owner, a sponsor and its own Conditional Access policy — gate one and gate two from a single console.
The gateways bolting on identity
Cloudflare’s identity-aware AI Gateway, in open beta since 5 August 2026, attaches the Cloudflare Access user id to each request so that spend limits and anomaly detection — flagging a session above twice a user’s 30-day 95th-percentile cost — apply per identity rather than per API key. Kong’s Agent Gateway does the equivalent for LLM, MCP and agent-to-agent traffic. Both are useful; both also confirm the essays’ point, since a gateway that has to import identity from elsewhere is a gateway that cannot work without an agent identity layer beneath it.
The standards
Two standards efforts matter most. The IETF draft on AI agent authentication and authorisation, revised on 6 July 2026, combines WIMSE and SPIFFE workload identifiers with OAuth 2.0 delegation and Shared Signals for revocation — the vocabulary for gates two, three and six. NIST’s National Cybersecurity Center of Excellence opened a concept paper on software and AI agent identity in February 2026. An April 2026 arXiv paper on AI identity standards lists five structural gaps, including recursive delegation accountability and agent identity integrity, that none of the shipped products fully closes yet.
A 30-Day Agent Identity Plan for a UK Business
The sequencing essay ends with a 30-day plan that costs nothing but attention, and it translates directly to a UK small or mid-sized business using Microsoft 365, a CRM and a handful of automation tools. None of the three steps requires a gateway, which is the point.
Week one: name ten production agents
List ten agents that touch production data — Copilot agents, a Power Automate flow with an AI step, an MCP connector, a support bot, an autonomous AI agent handling tickets. For each, record a named owner, its purpose, the tools it may call and whether it is live, paused or retired. Most organisations discover they cannot get past five without asking around, which is itself the finding: the agent identity gap starts with not knowing what is running.
Week two: test whether IAM and logging can tell them apart
Pick three of the ten and check whether your identity platform and your logs can distinguish each agent from the human who launched it. If an agent runs under a shared service account or a person’s token, it fails the test. This is a cheap audit that any IT security function can run, and it maps directly to the 68% of organisations in the CSA survey that cannot make the distinction.
Weeks three and four: reconstruct one completed task end to end
Take one task an agent finished last week and try to rebuild it from the logs: which agent, on whose authority, which calls, in what order, with what outcome. If the reconstruction has gaps, gate four is missing, and it should be fixed before any enforcement is layered on top. That reconstruction is also what an incident response team will need on the day something goes wrong, and it is what an auditor will ask for under any serious compliance regime. Organisations building an AI strategy should treat the result as the baseline for every agent they add next.
The Limits of the Argument
The essays are persuasive, but three caveats deserve space before anyone reorders a security roadmap around them.
Two essays, two bylines, one headline
At the time of writing, the VentureBeat page carrying the “identity before a gateway” headline shows the byline of Ravindra Annam, and its body is the runtime-trust argument, while the six-gate sequencing argument appears under the companion headline and the byline of Nik Kale, an enterprise AI platform engineer. Whether that is a content-management mix-up or intentional pairing, this article attributes the arguments to the essays rather than to either author, and readers should check the live pages, which may have been corrected.
The standards are not finished
The IETF draft is a draft, the NIST paper is a concept paper, and the arXiv survey is explicit that recursive delegation accountability and agent identity integrity remain open problems. An organisation that builds gates one to four today will be building on vendor-specific implementations — Entra Agent ID, Okta’s extension, SPIFFE identifiers — that may not interoperate cleanly for a year or more. That is a reason to start with the inventory, which is vendor-neutral, rather than a reason to wait.
The surveys are vendor surveys
Every statistic above comes from a vendor with an identity product to sell: Palo Alto Networks, Okta, Teleport, Aembit and Token Security through the Cloud Security Alliance. The samples range from 205 to 2,930, the questions differ, and the incentives are obvious. The direction of every finding is the same, which is reassuring, but the precise ratios should be treated as indicative. The one figure with no vendor behind it — the CISA KEV entry for CVE-2026-42271 — is also the one that most directly supports the essays’ warning about gateways.
Agent Identity FAQs
What does “AI agents need their own identity before they need a gateway” mean?
It means that a gateway — the proxy that enforces policy on model and tool calls — can only act on what it can attribute, and attribution requires each agent to have a distinct identity carrying its owner, purpose and delegation context. Build the agent identity layer first; the gateway becomes useful at the fifth of six deployment gates.
What is the difference between agent identity and delegation context?
Agent identity says which actor made a call. Delegation context says whose authority it acted under and why. A finance agent running on a borrowed human token has neither: the credential is valid and the call is permissible, but nothing records that the action contradicted the purpose of the delegation.
Why is the gateway called the fifth control?
Because the dependency-gated deployment model in the essay orders the controls as inventory, agent identity and delegation, task-scoped credentials, attributable telemetry, runtime enforcement, then baselines and a kill path. Runtime enforcement is where the gateway lives, and it depends on the four gates before it.
What happened with LiteLLM in June 2026?
CVE-2026-42271, a remote code execution flaw in the LiteLLM gateway affecting versions 1.74.2 to 1.83.6, was added to CISA’s Known Exploited Vulnerabilities catalogue on 8 June 2026 with a federal fix deadline of 22 June. The essay uses it to argue that a gateway is an attack surface in its own right, not a neutral control.
How big is the agent identity gap in practice?
Palo Alto Networks counts 109 machine identities per human, up from 82 a year earlier. CSA surveys found 68% of organisations cannot distinguish agent from human activity, 82% have unknown agents, and 43% rely on shared service accounts. Only 37% can revoke an agent’s credentials.
What can a small business do about agent identity without new tools?
Run the 30-day plan: name ten production agents with an owner and purpose, test whether your identity platform and logs can tell each agent from its delegator, and reconstruct one completed task end to end from the logs. Microsoft Entra Agent ID and Okta Agent SSO can then give those agents first-class identity without a separate programme. For the wider picture on agent reliability and the tools involved, browse our AI models and tools hub.
References and Further Reading
VentureBeat: AI agents need their own identity before they need a gateway
VentureBeat: AI agents that pass authentication can still drift, expose data, or get memory-poisoned
NIST National Vulnerability Database: CVE-2026-42271 (LiteLLM)
Help Net Security: LiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271)
Palo Alto Networks: 2026 Identity Security Landscape report
Cloud Security Alliance: 82% of enterprises have unknown AI agents in their environments
Teleport: 2026 State of AI in Enterprise Infrastructure Security report
Okta: Okta brings first-class identity to AI agents with Agent SSO
Microsoft Learn: What is Microsoft Entra Agent ID
Cloudflare: Catching rogue AI behavior with identity-aware analytics
Kong: Introducing Kong Agent Gateway
IETF Datatracker: AI Agent Authentication and Authorization (draft-klrc-aiagent-auth)
NIST: New concept paper on identity and authority for software agents
arXiv: AI Identity — Standards, Gaps, and Research Directions for AI Agents
Ken Huang: The Gateway Is Not the Identity — Attested Trust for Agentic AI
More AI coverage: explore Progressive Robot's AI Models, Tools & Releases hub — hands-on reviews, setup guides and benchmarks in one place.