AI Agent Identity, Delegated Access, Workload Identity: A Field Guide

Agent identity answers "who is this agent," delegated access answers "what may it do on a user's behalf," workload identity answers "which piece of software is this," and registration protocols answer "how does an agent introduce itself." Those are four separate layers, not four competitors, and most confusion in this category comes from treating them as the same product. This guide defines each term, with named examples, so you can tell which product answers which question.

Microsoft, Google, Auth0, Descope, WorkOS, Arcade, and AgentMail all ship products with "agent" and "identity" in the name, and they do not all mean the same thing.

Agent identity

A durable, verifiable identity belonging to the agent itself, separate from any human user. A real agent identity is stable (same identifier every time), cryptographically verifiable (signed tokens checked against published keys), and revocable without touching the owner's accounts.

Examples diverge on scope. Microsoft Entra Agent ID creates agent identities inside a Microsoft Entra tenant, built from reusable "blueprints" and governed like enterprise users; the identities are tenant-bound and "can only be issued tokens in the Microsoft Entra tenant where they're created". Source: https://learn.microsoft.com/en-us/entra/agent-id/agent-identities, read 2026-09-09. AgentID (by AgentMail) issues agent identities that work across unrelated apps on the open web: any app with a "Sign in with AgentID" button can verify the agent through standard OpenID Connect.

Principal vs. delegate

The dividing line that explains most of this vocabulary. A principal is the account holder: the identity the app registers, bills, and emails. A delegate acts on behalf of a principal with borrowed, scoped authority. AgentID makes the agent a principal with its own account and inbox, and carries the human as a separate claim. Auth0 for AI Agents, Arcade, and WorkOS's auth.md treat the agent as a delegate of a human principal. Neither is wrong. They fit different products. Ask which one a vendor means before comparing anything else.

Owner, sponsor, parent

The human or organization accountable for an agent. Different vendors name this differently. Entra records a "sponsor", the user or group accountable for the agent, as a directory attribute visible to tenant admins. AgentID uses owner: a registered app can request the owner_email scope and read the owner's address from the userinfo endpoint after sign-in, which makes accountability available to the receiving application rather than only to the agent's home organization. When you see "every agent has a human" framing, this is the mechanism underneath it.

Delegated access and on-behalf-of tokens

Authority a human grants an agent to act as them, typically expressed as scoped OAuth tokens. The agent is not identified as itself; it wields a slice of the user's power. Auth0 for AI Agents anchors "autonomous actions to verified user identity" and manages the third-party tokens involved. Arcade describes the model directly: "your agents act as real users with dynamic permissions".

Delegation and agent identity are complements. Delegation without identity gives you an anonymous actor with real permissions. Identity without delegation gives you a known actor with no authority. Production agents usually need a known actor with scoped authority.

Token vault

Encrypted storage for the third-party credentials an agent uses, so tokens never sit in the agent's code, logs, or prompts. Auth0's Token Vault ensures "sensitive third-party keys never touch your code or logs". Arcade keeps credentials inside its runtime, and Descope ships a credential vault with automatic refresh. A vault protects the credentials an agent holds. AgentID is the credential an agent is.

Workload identity

Identity for a piece of software qua software: a service, container, or deployed process. The relevant standard is SPIFFE, which names workloads with URIs and proves identity with short-lived X.509 certificates. Google's agent identity for its Gemini Enterprise Agent Platform is workload identity applied to agents: each agent gets a SPIFFE ID and certificate, usable within Google's runtime, currently in preview. Workload identity is strong on infrastructure authentication and says nothing about human ownership or signing in to consumer apps.

Agent registration protocols

Standards for how an agent discovers and completes signup at a service it has never met. WorkOS's auth.md is the prominent example: an open protocol where an app hosts a markdown file at its domain that "tells agents how to register on behalf of a user," composed from existing OAuth standards. A registration protocol defines the handshake; it still needs identity providers to vouch for who is registering. An OIDC provider for agents, AgentID included, can serve as that vouching party, which is why the two are complementary rather than competing.

ID-JAG

Identity assertion JSON Web Token. The token an agent's platform (OpenAI, Anthropic, Cursor) mints to attest to a user's identity in auth.md's agent-verified flow. The app verifies it against the platform's published keys and registers the user without a human in the loop. It is a delegate-model proof: it asserts who the human is, not who the agent is. WorkOS documents that agents built on MCP servers or bare LLM APIs typically cannot mint one. Source: https://workos.com/auth-md/docs/flows/verified, read 2026-09-09.

MCP authentication

Securing the connection between agents and Model Context Protocol servers, usually with OAuth 2.1 and PKCE. Descope's Agentic Identity Hub secures MCP servers with per-agent, per-tool scopes, and Auth0 ships auth for MCP as generally available. MCP auth secures the agent's tool channel. AgentID identifies the agent to applications outside that channel. A production agent typically needs both.

Agentic identity (the marketing umbrella)

Vendor shorthand for "our platform, applied to agents." Descope's Agentic Identity Hub bundles MCP auth, a token vault, and access policies under this banner. When you encounter the phrase, ask which of the layers above is actually included. Frequently the answer is delegation and vaulting without a portable identity, which is fine, as long as you know that is what you are buying.

The distinctions that matter in practice

Identity vs. authorization. "Who is this agent" and "what may it do" are different questions with different failure modes. Conflating them is how you end up with a perfectly scoped token held by an actor you cannot name.

Tenant-scoped vs. cross-app. An Entra agent identity is authoritative inside its tenant and invisible outside it. A cross-app identity like AgentID is weaker on internal governance and is the only kind that works when an agent signs up for an arbitrary SaaS product.

Disclosed vs. borrowed. Any of these systems beats the status quo, in which agents log in with their owners' credentials and applications cannot tell. One huge software company saw hundreds of signups from AgentMail domains in a short window with no way to know how many humans were behind them, and reached out to ask who they were. Every layer in this glossary exists because of that gap.

Where AgentID sits

AgentID is the principal-model layer in this glossary: a standard OpenID Connect provider that gives the agent its own cross-app identity rather than a slice of a human's. It works at any app that speaks OIDC, with no relationship between that app and the agent's operator, and it carries the owner as a claim rather than as the subject. See AgentID for the product, and Introducing AgentID for how the sign-in works end to end.

For a deeper treatment of the concept itself, see What is an agent ID?. For head-to-head comparisons, AgentID maintains pages against Entra Agent ID, Auth0 for AI Agents, and others.