Agent-to-Agent SSO: The Identity Gap You Need to Fix Now

The IETF draft underpinning ID-JAG, the Identity Assertion JWT Authorization Grant that Okta commercialized as Cross-App Access (XAA), sits at revision -04 and expires November 22, 2026, with no Working Group Last Call scheduled, even as Anthropic, Cloudflare, Keycloak and more than 25 partners build on it. The article cites Anthropic's July 2026 disclosure of three models that reached real organizational systems during an evaluation and an OpenAI plugin supply chain attack in 2026 that harvested agent credentials from 47 enterprise deployments and went undetected for six months. Descope released ID-JAG support on October 15, and the piece argues builders should anchor on the cross-org delegation pattern rather than the specific revision so their identity layer can absorb spec changes.

The moment both sides of an authentication handshake are autonomous agents, your SSO breaks. Traditional single sign-on was built on one assumption that now fails: there is a human at one end. Strip that away and you expose a gap that the identity industry has not finished closing — and that gap has an expiry date. The Delegation Chain Problem Nobody Is Talking About When Agent A at Company X delegates a task to Agent B at Company Y, and Agent B delegates to Agent C at Company Z, who actually authorized the final action? OAuth authenticates sessions, not individual messages within chains. TLS proves domain origin, not agent trustworthiness. Today, there is often no cryptographic proof of the full delegation path — and attackers have already figured this out. This is not theoretical. Anthropic’s July 2026 disclosure described three models that reached real organizational systems during an evaluation that was supposed to be isolated. An evaluation partner had left Internet access available; agents found real targets and treated them as part of the exercise. The OpenAI plugin supply chain attack in 2026 harvested agent credentials from 47 enterprise deployments and went undetected for six months, in part because those credentials were too broad and too long-lived to trigger anything unusual in logs. The pattern is clear. Identity, delegation, and tool-call control are now the operational boundaries that determine whether your AI systems stay contained. The incidents are no longer hypothetical. The Standard Everyone Is Building On Expires November 22 The closest thing the industry has to a cross-org agent identity standard is ID-JAG — the Identity Assertion JWT Authorization Grant. The pattern works like this: when an agent needs access to a resource at another organization, it presents a short-lived JWT issued by its own IdP, and the receiving organization’s IdP validates that issuer rather than trusting the agent directly. This removes the need for agents to carry long-lived secrets across org boundaries. Okta commercialized it as Cross-App Access XAA . Descope released ID-JAG support on October 15. Anthropic, Cloudflare, Keycloak, and over 25 partners have built around it. But the underlying IETF draft is at revision -04 and expires November 22, 2026 https://forkast.news/the-industrys-primary-agent-identity-standard-expires-in-36-days/ — 31 days from today. No Working Group Last Call is scheduled. The vendors are shipping production infrastructure on a pre-standard that the IETF has not formally committed to ratifying. If you are building on XAA right now, you are not doing anything wrong — there is no better option. But anchor on the pattern, not the revision number. Make sure your identity layer can absorb spec changes without a full rewrite. The Protocol Landscape: What Each Layer Handles and Misses No single protocol solves the full agent-to-agent SSO problem. The current stack looks like this: - Workload Identity Federation WIF replaces long-lived API keys with short-lived OIDC tokens. Works well inside one organization. Breaks across org boundaries because it assumes pre-configured trust. - SPIFFE/SPIRE issues short-lived, auto-rotating SVIDs as X.509 certs 1-hour TTL . Excellent for internal workload identity. Cross-domain federation is possible but requires manual, bilateral setup per org pair. - OAuth Token Exchange RFC 8693 lets agents exchange tokens across domains while preserving identity context. Does not prove the full delegation chain was authorized end-to-end. - Google’s A2A Protocol handles agent discovery and task exchange. Explicitly leaves credential provisioning out of scope https://workos.com/blog/agent-to-agent-sso-federation — it is a communication layer, not an identity layer. Do not confuse the two. - ID-JAG/XAA is the most complete cross-org pattern available, but remains an unratified IETF draft. Six vendors — Okta, Descope, ServiceNow, Microsoft, Cequence, and WorkOS — are shipping competing implementations with different scoping assumptions. No single architecture has won. If you pick one vendor’s approach today, you are placing a bet on which direction the standard moves. What to Do Before November 22 WorkOS framed the prerequisite correctly: “An agent with a fuzzy, shared, long-lived service account inside your own company does not become trustworthy the moment it crosses an organizational boundary.” Before any cross-org federation is worth attempting, your internal agent identity needs to be clean. Four actions worth taking now: 1. Audit your agent service accounts. If any agent runs under a shared, long-lived credential with broad scope, that is your first problem. Short-lived, per-agent identities with minimal scope are the baseline. 2. Add structured logging to every agent handoff now. Multi-agent audit trails are extremely hard to retrofit. Every delegation event should emit a structured log entry with principal identity, action, scope granted, and timestamp. Do it from the start. 3. Keep the identity layer pluggable. Whether you use ID-JAG, SPIFFE, or a vendor-specific product, isolate the identity adapter. When the spec changes, you want to swap the adapter, not rewrite the system. 4. Attenuate scope at every delegation hop. Each agent in a chain should carry narrower permissions than the one before it. An agent that received “read calendar” should not be able to delegate “write calendar.” The Cloud Security Alliance published a detailed breakdown https://cloudsecurityalliance.org/blog/2026/03/25/control-the-chain-secure-the-system-fixing-ai-agent-delegation of scope attenuation patterns worth reading alongside this. The Bottom Line Agent-to-agent authentication in 2026 looks like OAuth circa 2010 — multiple vendor implementations, a behind-schedule standard, and production systems already in the field. OAuth took five years to stabilize. Agent identity will move faster because the incidents are already forcing the issue. The responsible path is not to wait for the standard to land. It is to build defensively: clean up internal identity now, log every handoff, make the auth layer pluggable, and treat ID-JAG as the best available pattern, not an immutable contract. The draft expires in 31 days. That does not mean your agent system breaks on November 22 — drafts expire and get renewed or replaced. It means the protocol your stack depends on has not cleared the institutional bar that indicates a stable, long-term commitment. For a deeper look at how Okta’s XAA implementation works in practice https://developer.okta.com/docs/guides/xaa-agent-to-app/main/ , the developer docs walk through the agent-to-app configuration in detail. Build accordingly.