Why agentic identity
Traditional IAM assumes a small set of actors: users, applications, and service accounts. Agentic systems add a new class of actor: software that can reason, call tools, delegate work, and hold temporary authority on behalf of a person or organization.
That changes the center of gravity.
The new problem
Agentic applications need more than login:
- A user needs to authorize an agent for a task, not permanently hand over account access.
- An agent needs scoped tool access that can expire, be inspected, and be revoked.
- A service needs to know whether it is dealing with a human, a first-party automation, a third-party agent, or a delegated chain.
- Operators need audit events that describe intent, delegation, and tool use, not only token issuance.
Traditional identity platforms can be made to do some of this, but usually through policy glue, custom service accounts, brittle consent screens, and operational overhead.
Our position
TCTDX Identity should make agent authorization a product primitive.
That means the software should expose:
- Actor clarity: humans, agents, tools, clients, organizations, and services are distinct.
- Delegation records: authority is granted with purpose, scope, subject, actor, expiry, and revocation state.
- Tool-aware scopes: permissions map to concrete tools and operations, not vague all-or-nothing API access.
- Inspectable sessions: agent sessions can be traced back to the human, client, tenant, and policy that created them.
- Safe defaults: short-lived grants, explicit consent, rate limits, and audit events are built in.
Why this reduces IAM hassle
Most teams do not want to operate a sprawling identity platform just to ship secure agent workflows. They want correct protocols, secure defaults, useful audit history, and a manageable cloud path.
The goal is to reduce required resources by removing repeated platform work:
- no custom OAuth edge cases per product,
- no separate agent delegation service for every team,
- no hand-rolled consent and revocation pages,
- no unmanaged signing-key lifecycle,
- no bespoke audit system for each agent tool surface.
The platform should make the secure path the shortest path.