The enterprise transition to AI agents is hitting a fundamental infrastructure wall: the reliance on static, long-lived API keys. These credentials, often stored in plain text or configuration files, represent a significant security liability. A new approach is emerging to replace these standing permissions with identity-governed, short-lived tokens issued at runtime. This shift represents a move toward treating agents as first-class identities rather than generic machine principals.
At Oktane 2026, Okta unveiled its Runtime Agent Gateway, a component designed to sit in the execution path between an agent and its tool calls. The goal is to enforce policy and log interactions in real time. While the company announced general availability for Agent SSO, Agent-to-Agent Connections, and Resource Access Certifications on September 22, 2026, the agent gateway itself remains on the roadmap. According to a third-party identity tracker, there was no general availability release for the gateway through October 7, 2026, with the underlying APIs having moved to beta on September 16, 2026.
The deeper issue is how these systems handle authorization. Okta’s Securing the agentic enterprise blog outlines the Identity Assertion Authorization Grant (XAA) flow, which implements the ID-JAG Internet-Draft. In this model, the gateway submits an inbound token and requested scope to Okta’s token endpoint. The Secure Token Service then brokers consent and returns a short-lived, one-time-use ID-JAG token. This token is downscoped to the specific task and carries both the human user’s sub claim and the agent’s nested act claim, effectively preserving the delegation chain. As the blog notes, the agent never holds a raw credential for the tools it uses; instead, the token is minted at the moment of the request, audience-bound, and revocable in seconds.
Ric Smith, President of Products and Technology at Okta, framed the challenge: “The challenge businesses face is the same access that makes agents powerful also makes them dangerous. For over a decade, Okta has continuously modernized how the workforce authenticates and connects to every app they use. That same discipline extends to AI agents. Our goal is to give enterprises the visibility and runtime assurance they need to turn AI agents from an unmanaged security risk into a massive competitive advantage.”
Ryan Barnes, Director of IT at MJS Packaging, added: “Moving fast with AI agents should not mean sacrificing control. Okta for AI Agents gives us the governance to deploy across the enterprise, accelerating innovation while eliminating security blind spots.”
Despite the gateway being pre-GA, the market is not waiting. Third-party enforcement points are already shipping. Aembit became the first third-party enforcement point for the XAA protocol, and TrueFoundry integrated the protocol into its own gateway on October 1, 2026. This activity highlights a broader trend where infrastructure, rather than model quality, is the primary bottleneck to enterprise adoption, as noted in recent analysis. Governance is the primary gating constraint.
Looking ahead, Okta plans to bring expanded kill switch capabilities to the runtime layer in Q4. This feature will allow administrators to revoke every active token held by a compromised agent and shut down sessions in flight using the Shared Signals Framework. This development aligns with broader industry movements, such as Microsoft’s Project Perception, which treats internal agents as insiders requiring continuous supervision. While the full vision of a governed agentic enterprise is still being built, the shift from static keys to identity-governed tokens is already underway.