Identity and Cryptographic Attestation

Proving which device, model, agent and person is behind an action.

Agents now get identities of their own: Microsoft gives each agent an Entra Agent ID, Visa and Mastercard sign agent payment requests, and China published a seven-part agent identity standard on May 22, 2026. Only 34% of organizations apply the same security controls to agents as to human workers, per Okta.

Chain of trust for AI agents: Hardware root, NVIDIA GPU attestation; Model, OpenSSF model signing; Agent, Entra Agent ID · China GB/Z 185 codes; User delegation, FIDO agentic authentication; Action, Visa Trusted Agent Protocol; Content, China GB 45438 labels CHAIN OF TRUST, ONE NAMED CONTROL PER LAYER Hardware rootNVIDIA GPU ATTESTATION ModelOPENSSF MODEL SIGNING AgentENTRA AGENT ID · CHINA GB/Z 185 CODES User delegationFIDO AGENTIC AUTHENTICATION ActionVISA TRUSTED AGENT PROTOCOL ContentCHINA GB 45438 LABELS
Organizations securing agents like workers
34%
Okta customers eligible for Agent SSO
20,000+
Organizations behind China GB/Z 185
70+
Registry failures
1

Registry

One failed identity control in the registry, in the Hugging Face Breach

Each row is a control that was in place, or should have been, and did not hold. The incident record explains who was responsible and what changed afterward.

Registry incidents where identity and attestation failed
IncidentDateControlResponsibleWhat failed
OpenAI Test Models Breach Hugging FaceJul 2026Non-human identitiesHugging FaceStolen worker secrets led to Kubernetes administrator access

Implementations

Directories, payment networks and China's standards body each issue agent identities

Microsoft and Okta treat an agent as a directory identity with its own access policy. Visa and Mastercard identify agents at the payment request, using HTTP message signatures checked at the CDN. China's GB/Z 185 series gives each agent a hierarchical identity code that a registration provider can suspend or revoke. Below the agent, NVIDIA releases model keys only after GPU attestation, and OpenSSF signs the model files themselves.

Named identity and attestation implementations
ImplementationVendor or bodyCountryWhat it enforcesStatus
Agent Pay agentic tokensMastercardUnited StatesAgents registered before they transact; tokenized credentialsOct 2025
Agent SSO and Cross App AccessOktaUnited StatesRegisters agents in the directory; swaps stored credentials for short-lived tokensGA Aug 24, 2026
Confidential Computing with remote attestationNVIDIAUnited StatesModel keys released only after GPU and CPU attestation passesJul 2026
Entra Agent IDMicrosoftUnited StatesOwn directory identity, lifecycle and Conditional Access for each agentGA with Agent 365, May 2026
GB/Z 185-2026 agent interconnection seriesSAMR and SACChinaUnique hierarchical identity code per agent; issue, suspend and revokePublished May 22, 2026 (guidance)
Model signing v1.0OpenSSF (Google, NVIDIA, HiddenLayer)United StatesSigstore signatures for model files of any formatReleased Apr 4, 2025
Trusted Agent ProtocolVisa with CloudflareUnited StatesSigned agent requests (RFC 9421) checked against an agent registryLaunched Oct 14, 2025

Row color shows the agent class served: orange physical, teal personal and ambient, blue software.

Recent events

  • NIST CAISI launched its AI Agent Standards Initiative on February 17, 2026, with agent identity as a focus.
  • FIDO Alliance opened agentic authentication and payments working groups on April 28, 2026, with Mastercard and Visa chairing payments.
  • Okta made Agent SSO generally available on August 24, 2026.
  • Hugging Face attackers used stolen worker secrets to reach Kubernetes administrator access in July 2026.

Exposure

Identity and authentication rates very significant or critical for eight of 17 agent types

The identity and attestation discipline covers the identity and authentication dimension of the agent attack surface ratings. These agent types depend on it most.

Agent types most exposed on this dimension
Agent typeDimensionRatingWhy
Enterprise agentsIdentity and authenticationCriticalEach agent holds non-human identities and tokens across systems
Robotaxis and autonomous vehiclesIdentity and authenticationVery significantRider accounts, payment methods, fleet operator credentials, and remote operator access each represent compromise paths
Fleets and swarmsIdentity and authenticationVery significantOperator credentials for the orchestration layer are the highest-leverage credentials in the system
Phones and tabletsIdentity and authenticationVery significantPlatform accounts (Apple ID, Google account, Microsoft account) tie identity to all device AI features
Smart home assistantsIdentity and authenticationVery significantPlatform accounts (Amazon, Google, Apple, Samsung) tie identity to all integrated devices
Coding and research agentsIdentity and authenticationVery significantDeveloper credentials, repository tokens, vendor API keys, deployment credentials all flow through the agent's working environment
Workflow agentsIdentity and authenticationVery significantService accounts, OAuth tokens across integrated tools, enterprise identity infrastructure
Commerce agentsIdentity and authenticationVery significantUser credentials, agent operator credentials, payment account access, brokerage credentials, banking authority

Rules

Agent identity rules are drafts and working groups; only China has published a standard

Rules and standards for identity and attestation
RuleJurisdictionWhat it requiresStatus
GB/Z 185-2026 AI agent interconnectionChinaUnified agent identifiers with update, suspend and revoke actionsPublished May 22, 2026 (guidance)
NCCoE agent identity and authorization concept paperUS (NIST)Identification, authorization, audit and non-repudiation for agentsComments closed Apr 2, 2026
IETF draft-klrc-aiagent-authInternationalAgents as workloads: WIMSE/SPIFFE IDs, mTLS or HTTP signatures, OAuth delegationIndividual draft, Mar 30, 2026
FIDO agentic authentication programInternationalUser authorization of agents and trusted delegation for commerceWorking groups formed Apr 28, 2026
China AI content labeling measures and GB 45438-2025ChinaVisible and metadata labels identifying AI-generated contentEffective Sep 1, 2025

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Limits

Identity tells a system who is acting, not whether the action is safe

A correctly identified agent can still be steered by prompt injection or act outside its task, so identity has to be paired with access limits and envelopes.

Record

Page Record

Datasets
ai_control_implementations.csv (7 rows for this page); ai_incident_controls.csv (1 linked); ai_attack_surface.csv
Key sources
Mastercard
Microsoft
NVIDIA
Okta
OpenSSF (Google, NVIDIA, HiddenLayer)
SAMR and SAC
Source notes
GB/Z 185-2026 agent interconnection series: secondary source; Trusted Agent Protocol: secondary source
Last verified
October 2026