A New Identity Playbook for AI Agents: Securing the Agentic User Flow – Source: securityboulevard.com

Agentic User Flow: A New Identity Model in Action

Human or Delegating Agent Authenticates to Actor Agent

The journey begins when a human (or delegating agent) authenticates to the actor agent via OIDC and a trusted IDP (e.g., Azure AD, Okta, Google).

Passwordless MFA (passkeys, FaceID) ensures secure, frictionless authentication—no shared secrets at risk.

Establish Subject-Actor Trust

OAuth frameworks bind:

• Subject: the human or delegating agent.
• Actor: the AI agent carrying out tasks.

The subject may grant fine-grained permissions to the actor using OAuth scopes, ensuring delegated rights are explicit and limited.

Subject Directs the Agent

The human or delegating agent issues the command (e.g., “Buy concert tickets using my company card”). The actor agent accepts the task within its scoped authority.

Intent is clear; delegation is bound by policy.

Agent Discovers Where and How to Act

The agent queries MCP (Model Context Protocol) or similar discovery mechanisms to:

• Identify the right APIs, services, and endpoints.
• Map its plan for fulfilling the assigned task.

This ensures resource access is intentional and traceable.

 Agent Authenticates to MCP Bridge

• Public agents use PKCE for secure, secret-less proof-of-possession.
• Trusted/internal agents use SPIFFE/SPIRE X.509 SVIDs for mTLS and client auth.

Strong, verifiable agent identity protects APIs from unauthorized access.

Just-in-Time (JIT) Provisioning

Once authenticated:

• Maverics provisions the agent on demand into the agent registry (IDP).
• Full profiles for long-lived agents or ephemeral Agent IDs for short-lived tasks.
• Attributes like TTL, purpose, risk, and delegation are attached.

No orphaned credentials. Every agent is governed, contextual, and ephemeral as needed.

Policy Evaluation by PDP + PEP

The agent’s request triggers layered evaluation:

• Coarse-grained controls (API, resource, method-level).
• Fine-grained authorization via OPA/ABAC: purpose, task, risk level, and delegation context checked.
• Policies reference both IDP-stored attributes and OAuth token claims.

Zero Trust enforced at every level of access.

Human-in-the-Loop + Up-Authentication

For sensitive actions:

• Liveness validation (biometric, challenge-response) ensures the subject is present.
• Passwordless MFA (e.g., FaceID push) enforces step-up security.
• The subject actively approves or denies the agent’s action.

Final authorization aligns with verified human intent and ensures no bot or fake subject or actor is involved preventing fraud.

Execution + Observability

Once approved:

• The agent executes only authorized API calls.
• All steps—including subject, actor, delegation, purpose, resource, policy decisions—are logged.
• Data feeds a centralized, OTEL-compatible logging system for compliance, SIEM, and audit.

Full forensic trail supports trust, accountability, and regulatory readiness.