{"slug": "okta-advances-agent-identity-framework-as-market-builds-around-pre-ga-standards", "title": "Okta Advances Agent Identity Framework as Market Builds Around Pre-GA Standards", "summary": "Okta announced general availability on September 22, 2026, for Agent SSO, Agent-to-Agent Connections and Resource Access Certifications, but its Runtime Agent Gateway, unveiled at Oktane 2026, remained pre-GA as of October 7, 2026, with its underlying APIs in beta since September 16, 2026, according to a third-party identity tracker. The gateway implements the Identity Assertion Authorization Grant (XAA) flow based on the ID-JAG Internet-Draft, minting short-lived, one-time-use, audience-bound tokens that carry the human user's sub claim and the agent's nested act claim so agents never hold raw tool credentials. Aembit became the first third-party enforcement point for XAA and TrueFoundry integrated the protocol into its gateway on October 1, 2026, while Okta plans expanded kill switch capabilities in Q4 using the Shared Signals Framework.", "body_md": "The enterprise transition to AI agents is hitting a fundamental infrastructure wall: the reliance on static, long-lived API keys. These credentials, often stored in plain text or configuration files, represent a significant security liability. A new approach is emerging to replace these standing permissions with identity-governed, short-lived tokens issued at runtime. This shift represents a move toward treating agents as first-class identities rather than generic machine principals.\n\nAt Oktane 2026, [Okta unveiled its Runtime Agent Gateway](https://www.okta.com/newsroom/press-releases/ai-innovations-oktane-2026/), a component designed to sit in the execution path between an agent and its tool calls. The goal is to enforce policy and log interactions in real time. While the company announced general availability for Agent SSO, Agent-to-Agent Connections, and Resource Access Certifications on September 22, 2026, the [agent gateway](https://forkast.news/glossary/agent-gateway/) itself remains on the roadmap. According to a third-party identity tracker, there was no general availability release for the gateway through October 7, 2026, with the underlying APIs having moved to beta on September 16, 2026.\n\nThe deeper issue is how these systems handle authorization. Okta’s [Securing the agentic enterprise blog](https://www.okta.com/blog/ai/okta-securing-ai-agent-identity/) outlines the Identity Assertion Authorization Grant (XAA) flow, which implements the [ID-JAG Internet-Draft](https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/). In this model, the gateway submits an inbound token and requested scope to Okta’s token endpoint. The Secure Token Service then brokers consent and returns a short-lived, one-time-use ID-JAG token. This token is downscoped to the specific task and carries both the human user’s sub claim and the agent’s nested act claim, effectively preserving the delegation chain. As the blog notes, the agent never holds a raw credential for the tools it uses; instead, the token is minted at the moment of the request, audience-bound, and revocable in seconds.\n\nRic Smith, President of Products and Technology at Okta, framed the challenge: “The challenge businesses face is the same access that makes agents powerful also makes them dangerous. For over a decade, Okta has continuously modernized how the workforce authenticates and connects to every app they use. That same discipline extends to AI agents. Our goal is to give enterprises the visibility and runtime assurance they need to turn AI agents from an unmanaged security risk into a massive competitive advantage.”\n\nRyan Barnes, Director of IT at MJS Packaging, added: “Moving fast with AI agents should not mean sacrificing control. Okta for AI Agents gives us the governance to deploy across the enterprise, accelerating innovation while eliminating security blind spots.”\n\nDespite the gateway being pre-GA, the market is not waiting. Third-party enforcement points are already shipping. Aembit became the first third-party enforcement point for the XAA protocol, and TrueFoundry integrated the protocol into its own gateway on October 1, 2026. This activity highlights a broader trend where infrastructure, rather than model quality, is the primary bottleneck to enterprise adoption, as noted in [recent analysis](https://forkast.news/tgvp-infrastructure-not-model-quality-is-the-primary-bottleneck-to-enterprise-ai-agent-adoption/). Governance is the primary gating constraint.\n\nLooking ahead, Okta plans to bring expanded kill switch capabilities to the runtime layer in Q4. This feature will allow administrators to revoke every active token held by a compromised agent and shut down sessions in flight using the Shared Signals Framework. This development aligns with broader industry movements, such as [Microsoft’s Project Perception](https://forkast.news/microsoft-treats-ai-agents-as-insiders-and-the-containment-layer-just-arrived/), which treats internal agents as insiders requiring continuous supervision. While the full vision of a governed agentic enterprise is still being built, the shift from static keys to identity-governed tokens is already underway.", "url": "https://wpnews.pro/news/okta-advances-agent-identity-framework-as-market-builds-around-pre-ga-standards", "canonical_source": "https://forkast.news/okta-advances-agent-identity-framework-as-market-builds-around-pre-ga-standards/", "published_at": "2026-10-20 10:36:13+00:00", "updated_at": "2026-10-20 10:48:01.937405+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "agent-protocols", "artificial-intelligence"], "entities": ["Okta", "Runtime Agent Gateway", "Identity Assertion Authorization Grant", "ID-JAG Internet-Draft", "Ric Smith", "Aembit", "TrueFoundry", "Shared Signals Framework"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/okta-advances-agent-identity-framework-as-market-builds-around-pre-ga-standards", "markdown": "https://wpnews.pro/news/okta-advances-agent-identity-framework-as-market-builds-around-pre-ga-standards.md", "text": "https://wpnews.pro/news/okta-advances-agent-identity-framework-as-market-builds-around-pre-ga-standards.txt", "jsonld": "https://wpnews.pro/news/okta-advances-agent-identity-framework-as-market-builds-around-pre-ga-standards.jsonld"}}