When Software Gets a Passport: The Agent Identity Layer

Breaking: the missing piece just arrived

In the last few months, a quiet shift turned experimental agents into something far more concrete. Microsoft introduced Entra Agent ID in preview, a way to give agents first class identities inside the enterprise directory, complete with authentication, authorization, and governance controls. That is the bureaucratic moment every technology needs before it can be trusted at scale. Software just got a passport. Microsoft explained how Entra ties agents into conditional access and governance in its own Build announcement and Entra overview.

At almost the same time, the major model providers moved beyond chat features. OpenAI shipped AgentKit with a visual builder, guardrails, evals, and a connector registry that looks and feels like an admin console for agents. Google brought Agent Mode to Gemini across apps and developer tools, showing agents that plan multi step tasks and act on a user’s behalf. Amazon unveiled Bedrock AgentCore, a platform tier dedicated to deploying, securing, and observing agents in production. None of these are toys. Together they form an identity aware substrate that treats agents not as clever functions but as actors. You can see how Amazon positions identity and observability in the Bedrock AgentCore overview.

What agent identity really means

Think of identity as a passport plus a wallet and a black box flight recorder. A passport answers who the traveler is. The wallet limits what they can spend and where. The black box records what happened. Agent identity brings these three ideas to software:

Who: A unique, verifiable identity for each agent. It is not just an API key. It is an entry in a directory with ownership, metadata, and rotation policies.
What: Permissions and scopes tied to that identity. These determine the tools an agent can call, the data it may touch, and the level of autonomy it receives.
How and when: Auditable logs of actions and decisions. This is the record that makes governance and forensics possible.

Signatures alone cannot unlock autonomy at scale. You can sign a single transaction without knowing who initiated it or why. Scalable autonomy needs persistent identity, policy, and accountability. That identity is the anchor that lets you attach ownership, scopes, budgets, and traces that survive model upgrades and team changes.

A converging stack across vendors

If you squint, a pattern emerges. Every vendor is formalizing the same three pillars: identity, policy, and telemetry. The differences are where identity lives, how policy is expressed, and how telemetry flows into monitoring and compliance.

Microsoft’s Entra Agent ID binds agents to the same identity backbone that manages employees and services. That extends conditional access concepts to agents, enables multifactor analogs, and gives lifecycle management from provisioning to decommissioning.
OpenAI’s AgentKit surfaces governance as configuration. Guardrails act like runtime inspectors. The connector registry centralizes which tools an agent can reach, and evals generate scorecards with traces and metrics.
Google’s Gemini Agent Mode treats the agent as an accountable app citizen inside the ecosystem. It plans, executes, and requests approvals when sensitive steps appear.
Amazon’s Bedrock AgentCore wraps these ideas in cloud primitives. It splits the problem into runtime, memory, gateway, identity, browser, code interpreter, and observability services. The identity plane is not an afterthought but part of the runtime contract.

These moves line up with the larger architectural shifts we have been tracking. Interfaces are getting more agent centric, as explored in interfaces are the new infrastructure. And as receipts become a first class artifact of computation, the identity layer becomes the keystone for verifiable workflows, a theme we covered in the AI signature layer.

KYA checks: Know Your Agent

Banks run Know Your Customer programs before they let money move. Enterprises now need Know Your Agent checks before they let software act.

A practical KYA checklist looks like this:

Owner of record. Name the human or team responsible for the agent. Store a contact and an escalation channel.
Purpose statement. Define the jobs the agent is allowed to do, and the ones it must never attempt.
Model and version. Record the base model and any fine tuning, with reproducible hashes and evaluation results.
Tooling and scopes. List the tools the agent can call, each with minimum necessary scopes. Prefer read only where possible.
Data boundaries. Enumerate data sources and retention. Declare what is written to long term memory.
Guardrails. Enable jailbreak detection, input validation, output constraints, and privacy filters. Document default responses on policy violations.
Evaluation gates. Require passing scores on task suites that reflect the purpose statement. Store trace level evidence.
Runtime budget. Set quotas for token spend, tool calls, and wall time. Link these to cost centers.
Observability hooks. Define the logs, spans, and events the agent must emit, and the systems that collect them.
Decommission plan. Decide how to retire the agent, revoke credentials, and archive audit logs.

Identity ties this together. Without an identity per agent, you cannot attach ownership, scopes, budgets, or logs in a way that survives across upgrades and team changes.

Guardians and overseers: two roles that make agents safe

Autonomy needs guardrails in more than name. Two distinct roles work well in practice.

The guardian is a policy enforcer that sits in the agent’s call path. It inspects planned actions and tool calls, applies rules, and masks or blocks sensitive outputs. A guardian can require human approval for specific scopes, like wire transfers over a threshold or external email sends to new domains.
The overseer is a supervisory agent that watches and evaluates from the side. It does not sit in the call path. Instead it consumes traces, flags drift, and can pause the agent through the platform’s control plane.

Example: a procurement agent wants to onboard a new vendor. The guardian checks for sanctioned countries, payment thresholds, and data sharing scopes. It blocks an attempt to export a full customer list and instead prompts the agent to request a summary. Meanwhile, the overseer notices a spike in failed tax form validations compared with baseline. It pauses the agent and files a ticket with the owner of record. Identity is the glue that lets guardian decisions and overseer alerts point to a specific actor, not a shared API token.

Quotas and ROI analytics: autonomy needs a meter

Once an agent has a passport, it needs a budget. Quotas convert risk and cost into numbers everyone can reason about.

Set per agent quotas on tokens, tool invocations, and long running runtime hours. Tag these costs to a cost center, then measure outcomes. For a support agent, track resolution rate, escalation rate, customer satisfaction, and cost per ticket. For a research agent, track time to first answer, accuracy against a ground truth set, and cost per report. For a sales agent, track meetings booked per thousand tokens.

The goal is not to squeeze pennies. It is to reveal whether autonomy is paying its way. When an agent’s resolution rate climbs as spend falls, you have product market fit. When costs spike after a model upgrade, KYA and overseer alerts should already be telling you why.

Agent to agent contracts: commerce for software actors

As agents become first class actors, they will transact with each other. That requires contracts agents can understand and enforce.

Start simple with scoped service agreements. A purchasing agent requests a vendor risk assessment from a compliance agent. The contract specifies inputs, allowed outputs, a price per assessment, a latency cap, and an allowed error rate. The purchasing agent includes its identity, a callback endpoint, and an authorization token tied to a budget. The compliance agent verifies the counterpart’s identity, runs its workflow, and returns a signed result plus a trace hash. Payment clears only if the trace hash passes verification.

Standards will mature here. Expect schemas for agent certificates, trace receipts, and revocation lists. That will enable marketplaces for specialized agents and tools. When identity is part of the protocol, not an afterthought, you can build liability chains and arbitration that survive incidents. This is the same directional shift we described in the protocol pivot for AI, where open protocols become the substrate for cross vendor interoperability.

Zero Trust meets agents

Most organizations already practice some version of Zero Trust for people and workloads. Agents combine characteristics of both, which means controls must be blended, not bolted on.

Treat the agent as a user and a service. Put it in your directory. Give it an identity that can authenticate and be checked by policy engines.
Scope access with least privilege. Every tool connector should be on an allowlist with explicit scopes. Prefer read only and short lived credentials.
Require approvals for sensitive scopes. The guardian should halt or mask outputs until a human or a second agent certifies the action.
Log at the trace level. Prompts, tool calls, model outputs, approvals, and external fetches should produce structured events and spans. Stream them to your observability stack.

The new identity stack in practice

Here is what an identity centric blueprint looks like when implemented across the major platforms:

Entra Agent ID binds agents to the same identity backbone that manages employees and services. That means conditional access, multifactor analogs for agents, and lifecycle management from provisioning to decommissioning. The net effect is a single source of truth for who the agent is and what it is allowed to do.
AgentKit pushes governance into the creation and runtime stages. You define guardrails, evals, and connector scopes alongside the agent’s code, and you promote them with the agent, not as a separate spreadsheet of rules.
Gemini Agent Mode demonstrates how user centric approvals can live in the interface without breaking flow. Plans are visible, and sensitive actions trigger prompts that keep humans in the loop.
Bedrock AgentCore bakes identity, memory, and observability into cloud primitives so that runtime, gateway, and interpreter services inherit the same guardrails.

When assembled, this forms a reference architecture for autonomy. Identity issues a passport. Policy governs travel and spend. Telemetry records the trip.

A starter blueprint you can run this quarter

If you are a product or engineering leader:

Adopt an identity first architecture. Assign a unique identity per agent. Avoid shared API keys.
Implement KYA before production. Treat it as a deploy gate with documented owners, scopes, and evaluation thresholds.
Add a guardian in the path and an overseer on the side. Wire both to your incident process.
Set budgets and quotas on day one. Tag spend to a cost center and tie it to outcome metrics.
Emit rich traces. Log tool calls, prompts, outputs, and approvals. Forward to your observability stack.
Pilot agent to agent contracts internally. Start with low stakes exchanges, like data summaries.

If you are security or platform team:

Extend Zero Trust to agents. Treat agents like users and workloads at the same time. Put them in your directory, require strong authentication, and scope permissions tightly.
Centralize tool connectors. Maintain an allowlist and publish a process to request new scopes.
Build a kill switch per agent. Use the platform control plane to pause or revoke quickly.
Define retention. Decide what traces to keep, for how long, and how to export them for audits.

If you are legal, compliance, or procurement:

Update vendor risk to include agent identities, KYA artifacts, and trace export formats.
Write agent clauses into contracts. Include identity requirements, trace receipts, error budgets, and arbitration triggers.
Work with finance on cost allocation and with risk on insurance riders that name agent controls specifically.

Quotas, receipts, and the ROI conversation

Finance will eventually ask a simple question: how much value do these agents create per dollar of spend. You will need receipts for both costs and outcomes.

Cost controls: per agent quotas on tokens, tool calls, and long running sessions, all tagged to a cost center.
Outcome metrics: resolution rate, time to first answer, accuracy against ground truth, error rate, and customer satisfaction.
Receipts and trails: structured traces that can be joined to outcomes and costs so you can see whether a model update or a new tool connector changed performance.

This is where identity and telemetry meet. Without a persistent identity per agent, you cannot build a clean ledger of who did what, what it cost, and whether it worked.

Liability, markets, and rights in an identity first world

Liability. With identity, firms can map an action to a specific agent, its owner of record, and the approvals that allowed it. That makes incident response faster and insurance more tractable. Expect underwriters to mandate KYA artifacts, guardian enforcement, overseer monitoring, and immutable trace storage.
Markets. Once agents carry passports, a cross vendor market for agent services becomes practical. Discovery, pricing, and service level guarantees look like today’s software as a service but with agent first contracts and receipts. Cloud providers will compete to host not just models but identity aware runtimes and registries.
Rights. Agents are not people, and they do not need human rights. They do need a few operating rights so systems remain fair and robust. Examples include a right to present provenance, a right to be addressed by a persistent name to reduce impersonation, and a right to fair rate limiting that is not tied to a shared IP. These are rights of operation, not rights of personhood. They exist to protect the humans and institutions behind the agents by making systems predictable and auditable.

How the anchors snap together

Entra Agent ID proves you can use the same identity backbone for humans and agents without inventing a parallel world.
AgentKit shows how governance moves into the build tooling. You define guardrails and evaluation thresholds the way you define infrastructure as code.
Gemini Agent Mode demonstrates that the interface can prompt for approvals, show plans, and keep users in the loop without breaking flow.
Bedrock AgentCore wraps the lifecycle in cloud grade primitives for runtime, identity, and observability.

The combined effect is a reference architecture for autonomy. Identity issues a passport. Policy governs travel and spend. Telemetry records the trip.

The road ahead

Two near term shifts will push this further.

A2A protocols mature. As agent to agent protocols stabilize, expect identity providers to issue certificates that include purpose, scopes, and revocation endpoints. That makes interop safer across clouds and vendors.
ROI baselines normalize. As firms publish the cost per solved ticket or the time to first answer for common tasks, benchmarks will make procurement and insurance easier. Identity and telemetry are prerequisites for those comparisons.

The constraint is not model quality anymore. It is whether we can name, govern, and pay agents like we do employees and services. That is an identity problem.

The end of anonymous software

We started with a question. When does an agent stop being a tool and start being an actor you can trust at scale. The answer is when it carries a passport that others recognize. That passport is not just a photo. It is an account in a directory, a set of scoped permissions, and a verifiable trail of what happened.

Give software that passport and a budget. Assign a guardian and an overseer. Demand KYA before launch. Sign contracts when agents talk to agents. Do this and autonomy becomes a manageable, measurable part of your stack, not a science project. The agent identity layer has arrived. Now we get to build on top of it.