Let’s talk about the week your AI agent got an identity card.
Registered in the same directory as you. Next to your name. Next to your boss’s name. Governed from the same console, by the same admin, through the same workflows. One entry says “Phillip, human, sales.” The next entry says “Claude, agent, can touch Salesforce.”
If you missed it, here’s the news. On the 24th of August, Okta made something called Agent SSO generally available. That’s the identity company that most of the corporate world already logs in through. The pitch is simple and it is genuinely good security: instead of giving your AI agents static API keys that never expire and nobody can trace, you register the agent as a first-class identity, issue it short-lived tokens, and apply the same access policies you apply to people. The agent becomes auditable. You can see what it did, revoke it, kill it.
On its face, this is the responsible thing. For once, the machine gets a leash before it burns the building down.
Here’s what the press release almost tells you, and nobody is reading closely enough: the agent now sits in the directory alongside human employees. Not below them. Alongside.
That sentence is the whole story, and it’s not the story the vendor is selling.
Think about what an identity directory was for. For twenty years, that database answered one question: who is this person, and what are they allowed to do? It was the machinery of personhood inside a company. You, your access, your name, your record. The directory is where accountability lived, because the name on the entry was attached to a body that could be fired, sued, and answer for what that access did.
Now the directory has a new population. And it’s not a handful of experimental side-projects. Okta’s own research says organizations are adopting agents faster than they can govern them — only about a third apply the same security controls to their agents that they apply to their people. Which means the other two-thirds are already running agents as anonymous traffic. No owner. No policy. No audit trail.
That’s the honest part of the pitch, and it’s true: the machines were already acting. They were already calling APIs, moving data, drafting contracts, booking things, spending money. The question was never whether to give them identity. It was whether you’d be able to see them at all.
So yes, building them a registry is the responsible move. I’m not arguing against the technology.
But here’s what the pattern actually is. And it’s the same pattern every time.
Identity is being rebuilt as machine-first infrastructure. And the human is being folded in as a variable.
Look at the protocol underneath this, because that’s where the real game lives. Agent SSO is built on something called Cross App Access — an open, vendor-neutral standard that Okta says is now an official extension to the Model Context Protocol. The token an agent carries doesn’t just say “this agent is allowed in.” It says “this agent is acting for this user.” The authorization is keyed to a human owner.
Now read that again, slowly, because it’s the sharpest thing in the whole release.
The agent has the identity. The human has the ownership.
The machine gets the access. The human gets the responsibility. The machine is the actor. The human is the name on the entry that makes it legal. And when the agent does something wrong — signs the wrong contract, leaks the wrong file, spends against the wrong account — the directory knows exactly who to come looking for. It’s the name attached to the agent. The named human owner.
This is the accountability inversion I keep circling, and it’s getting harder to ignore. We built AI agents to act without us. Then we discovered they act without consequence. So the fix is not to make them answer. The fix is to find a human who will answer for them. The machine gets agency. The person gets the blame. The directory formalizes it: first-class identity for the agent, first-class liability for you.
That’s not a security feature. That’s a liability redistribution engine wearing a security badge.
And notice what it does to the meaning of identity itself. For a long time, identity meant “who a person is” — and your access flowed from that. Increasingly, identity means “what an actor is authorized to do” — and the person is just one more actor in the directory. The human isn’t the thing the system was built around anymore. The human is a column in the access table. A boolean attached to a token.
You can feel it in the language of the product. Okta for AI Agents doesn’t just register agents. It discovers them — including the shadow agents nobody approved — and then it “assigns them named human owners.” Think about that verb. Assigned. A human owner gets assigned to a machine, the way you’d assign a server to a department. The person isn’t the user of the system. The person is a governance attribute of the machine.
Now the operator lesson, because there always is one, and it’s worth being honest about.
There are two ways to read this week. The cynical way: Okta found the new control plane. Twenty years ago, whoever owned the login page owned the company’s access. Today, whoever owns the agent registry owns the company’s actions. Okta says it outright — “identity becomes the enterprise control plane.” They’re building the toll booth on the bridge every agent has to cross, and they’re giving it away at no cost on core plans, because the moat isn’t the free feature. The moat is being the directory that every agent and every human has to pass through. Free identity today, unavoidable dependency tomorrow. It’s the oldest platform play in the book, and it’s running at the layer where the real risk lives now.
That reading is true. But it’s not the whole truth, and I don’t want to be the guy who’s right about the cynicism and wrong about everything else.
Because the other reading is this: some accountability is better than none. The alternative to agent identity is not sovereignty. It’s agents running wild with no owner, no record, no kill switch — and when those agents break something, the blast radius lands on real people who had nothing to do with it and no way to trace it. A world where the machine acts and nobody can say who authorized it is not a world where the human is sovereign. It’s a world where the human is a victim.
So the build is worth doing. But do it with your eyes open.
The principle that has to survive is not “no machine identity.” That ship has sailed. The principle that has to survive is who holds the keys to the identity. If identity is something a system assigns you — a row in someone else’s directory, a token you never see, an owner you never chose — then the machine isn’t serving you. You’re serving its authorization. Sovereignty doesn’t mean refusing the registry. It means making sure the thing that holds your identity and your agent’s identity is something you control, can audit, can revoke, and can walk away from.
Because here’s the uncomfortable fact this whole thing is trying to paper over. The identity card the machine just got?
It’s the same card you’ve been carrying. And you didn’t get to read the terms.
The directory that just enrolled a million agents in first-class identity was the same directory that enrolled you. Same console. Same admin. Same database. And the moment your identity and the machine’s identity live in the same place, governed by the same rules, the difference between “human” and “agent” stops being a category of being and starts being just another field in the record. A tag. A label. One more thing a machine can be granted or stripped of.
That is the pattern nobody in the press release is going to tell you about. Because it’s not a bug. It’s the product.
So the question you should be asking isn’t “should my agents have identity.” They already do. The question is whether you — the human — still have an identity that is yours. Or whether, in the great directory of everything that acts, you’ve quietly become just another actor with a named owner of your own.
Because the one thing the machine can never do for you is answer. And the one thing you cannot delegate — no matter how many identity cards get issued — is being the one who does.