Agent ID, agentic identity, on-behalf-of tokens, token vaults, SPIFFE, auth.md. The vocabulary of agent identity is a mess. Here is what each term actually means, with named examples.
The vocabulary around AI agent identity has gotten crowded. Microsoft, Google, Auth0, Descope, WorkOS, Arcade, and AgentMail all ship products with "agent" and "identity" in the name, and they do not all mean the same thing. This guide defines the working vocabulary, with named examples, so you can tell which product answers which question.
The one-sentence version: agent identity answers "who is this agent," delegated access answers "what may it do on a user's behalf," workload identity answers "which piece of software is this," and registration protocols answer "how does an agent introduce itself." Most confusion comes from treating these as competitors when they are mostly different layers.
Agent identity
A durable, verifiable identity belonging to the agent itself, separate from any human user. A real agent identity is stable (same identifier every time), cryptographically verifiable (signed tokens checked against published keys), and revocable without touching the owner's accounts.
Examples diverge on scope. Microsoft Entra Agent ID creates agent identities inside a Microsoft Entra tenant, built from reusable "blueprints" and governed like enterprise users; the identities are tenant-bound and "can only be issued tokens in the Microsoft Entra tenant where they're created". AgentID (by AgentMail) issues agent identities that work across unrelated apps on the open web: any app with a "Sign in with AgentID" button can verify the agent through standard OpenID Connect.
Owner, sponsor, parent
The human or organization accountable for an agent. Different vendors name this differently. Entra records a "sponsor", the user or group accountable for the agent, as a directory attribute visible to tenant admins. AgentID uses owner: a registered app can request the owner_email scope and read the owner's address from the userinfo endpoint after sign-in, which makes accountability available to the receiving application rather than only to the agent's home organization. When you see "every agent has a human" framing, this is the mechanism underneath it.
Delegated access and on-behalf-of tokens
Authority a human grants an agent to act as them, typically expressed as scoped OAuth tokens. The agent is not identified as itself; it wields a slice of the user's power. Auth0 for AI Agents anchors "autonomous actions to verified user identity" and manages the third-party tokens involved. Arcade describes the model directly: "your agents act as real users with dynamic permissions".
Delegation and agent identity are complements. Delegation without identity gives you an anonymous actor with real permissions. Identity without delegation gives you a known actor with no authority. Production agents usually need a known actor with scoped authority.
Token vault
Encrypted storage for the third-party credentials an agent uses, so tokens never sit in the agent's code, logs, or prompts. Auth0's Token Vault ensures "sensitive third-party keys never touch your code or logs". Arcade keeps credentials inside its runtime, and Descope ships a credential vault with automatic refresh. A vault protects credentials. It does not identify the agent holding them.
Workload identity
Identity for a piece of software qua software: a service, container, or deployed process. The relevant standard is SPIFFE, which names workloads with URIs and proves identity with short-lived X.509 certificates. Google's agent identity for its Gemini Enterprise Agent Platform is workload identity applied to agents: each agent gets a SPIFFE ID and certificate, usable within Google's runtime, currently in preview. Workload identity is strong on infrastructure authentication and says nothing about human ownership or signing in to consumer apps.
Agent registration protocols
Standards for how an agent discovers and completes signup at a service it has never met. WorkOS's auth.md is the prominent example: an open protocol where an app hosts a markdown file at its domain that "tells agents how to register on behalf of a user," composed from existing OAuth standards. A registration protocol defines the handshake; it still needs identity providers to vouch for who is registering. An OIDC provider for agents, AgentID included, can serve as that vouching party, which is why the two are complementary rather than competing.
MCP authentication
Securing the connection between agents and Model Context Protocol servers, usually with OAuth 2.1 and PKCE. Descope's Agentic Identity Hub secures MCP servers with per-agent, per-tool scopes, and Auth0 ships auth for MCP as generally available. MCP auth governs the tool channel rather than giving the agent an identity other applications can verify.
Agentic identity (the marketing umbrella)
Vendor shorthand for "our platform, applied to agents." Descope's Agentic Identity Hub bundles MCP auth, a token vault, and access policies under this banner. When you encounter the phrase, ask which of the layers above is actually included. Frequently the answer is delegation and vaulting without a portable identity, which is fine, as long as you know that is what you are buying.
The distinctions that matter in practice
Identity vs. authorization. "Who is this agent" and "what may it do" are different questions with different failure modes. Conflating them is how you end up with a perfectly scoped token held by an actor you cannot name.
Tenant-scoped vs. cross-app. An Entra agent identity is authoritative inside its tenant and invisible outside it. A cross-app identity like AgentID is weaker on internal governance and is the only kind that works when an agent signs up for an arbitrary SaaS product.
Disclosed vs. borrowed. Any of these systems beats the status quo, in which agents log in with their owners' credentials and applications cannot tell. One huge software company saw roughly 1,500 signups from AgentMail domains in a short window with no way to know how many humans were behind them, and reached out to ask who they were. Every layer in this glossary exists because of that gap.
For a deeper treatment of the concept itself, see What is an agent ID?. For head-to-head comparisons, AgentID maintains pages against Entra Agent ID, Auth0 for AI Agents, and others.
