The Identity Problem Hiding in AI Agent Deployments

This blog post argues that deploying agentic AI across enterprises creates an identity problem because OAuth access tokens (as currently standardized) lack fields to express agent instance identity, the human user principal, and the relationship between them. The absence of a standard leads to inconsistent handling, coarse-grained authorization, auditability gaps, and risks like confused-deputy escalation; the authors call for standardization (either token fields or adjacent assertions) and note community discussion at IIW April 2026.