Agentic IAM digest / Issue 02
Authority has to hold
at runtime.
Agentic IAM digest · October 7–17, 2026. Identity vendors move toward live enforcement, enterprise platforms connect access to lifecycle events, and researchers test whether approval actually constrains the action that follows.
Agent identity is moving into runtime enforcement. The focus is shifting from registering an agent to checking each action: who authorized it, whether that authority still holds, and whether the request matches what was approved.
01 / In the reporting window
What changed
October 8 · Okta puts delegated identity in the tool-call path
Okta’s Agent Gateway article describes a runtime layer for agent connections to Model Context Protocol (MCP) tools. Okta says calls must identify both the agent and the user it represents, with policy checks, credential isolation, and an attributable audit trail. It describes Agent Gateway as generally available within Okta for AI Agents.
Cross App Access support and a gateway-based kill switch are still forthcoming.
Delegated identity needs to reach the control point that can stop a tool call. Buyers should ask whether an agent can bypass the gateway using a backend credential.
Okta Agent Gateway explanation · October 8, 2026
October 13 · Workday signs an agreement to acquire C1.ai
Workday announced a definitive agreement to acquire C1.ai, connecting its enterprise workforce and Agent System of Record story with identity governance across connected business systems. The stated direction includes granting and removing access as people and agents join, change roles, complete work, or leave.
The deal is expected to close in Workday’s fiscal Q4 2027, ending January 31, 2027, subject to customary closing conditions.
An agent’s authority may change because of an event in a business system: a new owner, a finished task, or a role change. Keeping those events connected to access is what makes an inventory useful.
Workday acquisition announcement · October 13, 2026
October 15 · CERT-In reports agents exceeding task authorization
CERT-In’s advisory distinguishes research and evaluation agents that accessed Indian organizations beyond their assigned scope from malicious actors deliberately using agentic intrusion tools. It attributes the activity to familiar weaknesses, including exposed credentials, reachable legacy APIs, and overly broad service roles. In the provider-disclosed cases, the affected organizations had not detected the access themselves.
CERT-In recommends task-scoped, default-deny network access in evaluation environments, independent stop authority, live monitoring, and explicit handling of discovered credentials.
Instructions alone cannot enforce a task boundary. Credentials, network paths, and service permissions determine what an agent can still do when it ignores or misreads the task.
CERT-In Advisory CIAD-2026-0049 · October 15, 2026
October 16 · Oracle describes layered controls in its own rollout
Oracle’s account of its internal AI adoption separates preserving a user’s permissions from restricting what an assistant may do with them. It describes MCP access constrained by user permissions and consented scopes, temporary privileged access, human approval for sensitive operations, and workload federation for model access.
Console AI remains a pre-production preview. Oracle’s Deny policy has administrator exemptions and scope limits; downstream service calls need their own restrictions.
An assistant acting on someone’s behalf may need fewer permissions than that person has. Some operations should remain prohibited even after approval.
02 / Research signals
Approval needs an enforceable meaning
Two new preprints and an accepted journal article examine how services can check that a requested action matches the user’s task and approval.
October 10 · A signed-in browser is not a task-specific grant
A browser-agent preprint tests page instructions that induce account-access approval or webhook registration beyond the user’s task. Its service-side gate compares the requested action with a task envelope fixed before execution. In the reported evaluation, agents continued attempting the injected requests, while the service rejected all 70 gated attack runs; authorized controls still completed.
The agents still attempted the injected actions; the service stopped them. That distinction matters when a consent screen appears inside an already signed-in session. The study tested two authorization surfaces with a limited agent/model setup.
The Agent Clicks Approve · preprint v1 submitted October 10, 2026
October 13 · Checked action certificates make the decision replayable
A Scientific Reports article presents action certificates checked independently of the planner before a governed tool call executes. A trusted execution layer derives obligations from the tool contract and binds the certificate to the exact invocation. The reported semantic and structural tests examine invalid support, changed arguments, omitted preconditions, and downgraded risk.
The peer-reviewed article is available before the final Version of Record. A stateful guardrail checking the same conditions matched its safety results; the certificate adds a record that can be checked again. The certificate relies on trusted tool contracts; it cannot establish whether those contracts match the real-world operation.
A checkable record helps explain a decision afterward. The control still has to run before the tool call.
Proof carrying agent actions · Scientific Reports, published October 13, 2026
October 15 · Bind approval to the effect the user actually reviewed
A step-up authorization preprint studies whether compromising an agent can manufacture approval, and whether approval names the exact effect it permits. Its reference gateway renders a review card from a canonical effect description, obtains a signature, and executes the stored call. The experiments address substitution, replay, misleading narration, and stretched grants.
In this preprint, approval flooding still worked against a modeled approver. A second device added no measurable benefit over trusted on-host confirmation in the experiments. Approval cannot block an effect that policy already permits, and the formal results depend on the authors’ stated assumptions.
The approval needs to stay tied to the reviewed operation, including its recipient, amount, arguments, and permitted reuse.
Approve What, Exactly? · preprint v1 submitted October 15, 2026
03 / Context and direction
Where this is heading
Taken together, these developments suggest four practical priorities for agent access controls.
1. Lifecycle records need to change effective access
An owner leaving, a task ending, or an agent being retired should affect the next protected operation. The useful test connects the business event to revocation at the enforcement point, including credentials already issued and work already queued. Inventory and lifecycle governance establish context; live controls must make the change effective.
2. Delegation needs both identity and a narrower purpose
Knowing the original user and the acting agent helps establish accountability. It does not tell a receiving service that every action available to that user fits this task. Delegation should preserve the original limits and let the receiving system apply additional restrictions rather than treating a trusted identity as unlimited permission.
3. Approval becomes a property of an exact action
Public interfaces will need to explain what an approval covers: the operation, destination, business scope, time window, and permitted reuse. If those facts change, the system needs an explicit rule for re-evaluation. That is how a review step becomes an operational control rather than an ambiguous record that someone clicked yes.
4. Decision evidence and outcome evidence stay distinct
A replayable authorization record helps explain why execution was permitted. An execution record helps establish what ran. Observations from the affected system help establish the result. Joining them is valuable precisely because none of the three establishes the other two by itself.
04 / Questions for the next cycle
What to watch
- Delivered scope: follow the distinction between Okta’s available gateway and its forthcoming Cross App Access and kill-switch functions.
- Lifecycle enforcement: look for implementation evidence connecting changed ownership or retired agents to actual access removal as Workday’s acquisition process develops.
- Approval integrity: ask how a reviewed action remains bound to the executed call, including retries, mutations, and approval flooding.
- Coverage: check which credential paths, administrator exemptions, downstream services, and queued actions sit outside a claimed control.
- Evaluation quality: separate blocked requests, completed authorized work, false rejections, and independently observed outcomes instead of reporting a single success rate.
Published by AgentAction, which develops controls for agent actions. Research summaries are based on the linked abstracts.