Agentic IAM digest / Issue 05
Make delegation
verifiable.
Agentic IAM digest · November 1–7, 2026. New drafts give task authority a clearer shape, CrowdStrike adds gateway containment, and a prototype shows where permission checks can break at a handoff.
When one agent hands work to another, the receiver needs to know who sent the request, what was delegated, and which limits still apply. A valid credential for the caller answers only the first question.
01 / What changed
Carry the limits with the work
November 2 · Two drafts give agent authority a clearer shape
The IETF WIMSE working group published revision 01 of its AI Identity Management System draft. It treats agents as workloads and describes how workload identity, OAuth delegation, and shared security signals can fit together. The aim is guidance for combining existing and emerging mechanisms, rather than a new protocol.
A separate individual OAuth draft proposes a durable record called a Mission. It binds a task and its approved authority to the approver’s consent. Tokens issued under that record carry a subset of the approved authority. Revoking the Mission stops new issuance; a service that checks only the token may still honor one already issued until it expires.
The two documents are works in progress. For teams designing an approval flow, they sharpen a practical question: can the service relate the credential it sees to the actual task someone approved?
AI Identity Management System · working-group draft 01
Mission-Bound Authorization for OAuth 2.0 · individual draft 02
November 3 · CrowdStrike makes its agent kill switch available at the gateway
CrowdStrike announced that its Falcon Guardian kill switch was available, with termination first at the gateway and endpoint termination still to come. The company describes an authorized administrator triggering a logged response, with controls to cut enterprise network access and block relaunch on targeted hosts.
Separately, CrowdStrike signed a definitive agreement to acquire Fiddler AI. Its plan is to add agent evaluation and traceability through Falcon Observe, with general availability planned for the fourth quarter of its fiscal 2027. The acquisition announcement describes a proposed transaction subject to closing conditions and a future integration.
Stopping new calls and verifying what happened before the stop are separate jobs. A response exercise should cover both, including requests that had already reached another service.
CrowdStrike kill switch announcement · November 3, 2026
CrowdStrike–Fiddler acquisition agreement · November 3, 2026
November 5 · Zetrix AI announces a cross-border agent identity pilot
Zetrix AI and the China Academy of Information and Communications Technology announced a Know Your Agent service based on verifiable credentials. Its design links an agent to a person or organization and lets a receiving service check delegated permissions. The proposed pilot would test whether those credentials and permissions can be recognized across jurisdictions while keeping trust decisions local. Participants are still subject to confirmation.
The useful evidence will be how a receiving service enforces a limit or learns that a credential was withdrawn. The announcement describes a pilot plan, so those results are still ahead.
Zetrix AI: Know Your Agent service and pilot plan · November 5, 2026
02 / Research signals
Valid evidence can still describe an overbroad grant
Gabriele Donno, Kashif Mehmood, and Katina Kralevska tested a prototype Agent2Agent workflow using a synthetic healthcare reimbursement case. The prototype separately authenticates each request and checks the evidence of authority inherited from earlier steps. It rejected 14 of 15 adversarial conditions in the study. The remaining test exposed a missing check that the delegated permissions stayed within their original bounds.
In a separate experiment, an intermediary with the shared key for authorization evidence could change the represented authority and produce evidence that still passed verification. That result concerns the prototype’s trust model. It does not show a general vulnerability in Agent2Agent deployments.
The preprint uses a fixed-depth local setup. Its strongest takeaway is about what to verify: authenticating the current caller is only one check. The receiver also needs evidence of who granted the authority and whether any restriction was widened along the way.
Authorization Propagation in Agent2Agent Systems · preprint v1, submitted November 4, 2026
03 / Context and direction
Where this is heading
Our reading is that delegation will become easier to assess when services can check the same three things at every handoff: the immediate caller, the grant it relies on, and the effect it is requesting. A grant that says “pay this supplier up to $500” has to survive translation into the target service’s account, recipient, amount, and currency fields.
The next test is withdrawal. Disable new credential issuance, try a credential that was already issued, and check what happened to a request the service had accepted just before the stop. Those are three different outcomes, and each needs its own evidence.
04 / What to watch
Questions for a delegation test
- Approval: can a receiving service tie a request back to the task and limits someone reviewed?
- Handoffs: can an intermediary change the recipient, amount, or other restriction and still pass verification?
- Containment: which calls stop at the gateway, and which can still reach a service by another path?
- Outcome: can the affected service confirm whether an operation completed before a stop or retry?
Published by AgentAction, which develops controls for agent actions.