Between August 24 and October 15, 2026, six vendors shipped agent identity products. Okta. Descope. Postman. ServiceNow. Cequence. Microsoft. Seven weeks. Six launches. Two landed on the same day.
In the same window, the IETF could not ratify a charter. 154 members backed forming a working group. 38 endorsed the proposed scope.
That ratio is the entire story. A 4:1 split on scope is not a negotiation โ it is a control that has been documented but not implemented. Everyone agrees the risk is real. Nobody agrees on what is being secured.
I have seen this signature before. In 2017 I spent four months inside Bancor's conversion logic ahead of the token sale and found three integer overflow paths in the conversion math. The team knew they had a correctness problem. They did not have a definition of "correct." That gap โ not the bug โ was the systemic exposure. Precision in audit prevents chaos in execution, and the precision has to start with the definition, not the patch.
Agent identity is in that state right now. The products are shipping. The definition is missing.
ID-JAG โ Identity Assertion JWT Authorization Grant โ sits at the center of this, and it is worth being exact about what it is, because the coverage has not been.
It is three known mechanisms wired in series. JWT assertion issuance, from RFC 7523, dated 2015. Cross-authorization-server token exchange, from RFC 8693, dated 2020. Scoped tokens, from OAuth 2.1 scope semantics. Nothing in ID-JAG is a new cryptographic primitive. It is a composition-level innovation, not an architecture-level one โ and that is fine, because the actual contribution is the shape of the chain: user to application to agent to resource, with the identity provider signing the root of the chain instead of every resource server validating its own link.
The question dominating coverage โ will ID-JAG become the standard โ is the wrong question. The right one is which layer the fight is actually on. There are three, and none of them appear in the launch material.
Delegation semantics: how does "agent A, acting for user U, re-delegated to agent B, scoped to S" get expressed end-to-end in a form an auditor can verify without trusting the log file? Unresolved by all six vendors.
Proof-of-possession: if the credential is stolen, does it die? Only Descope touches this layer, via SPIFFE and mTLS. Everyone else ships bearer tokens and calls it governance.
Revocation granularity: can you kill one hop in a chain without collapsing the rest? Only ServiceNow answers, with tiered execution and a kill switch โ coarse, but an answer.
The token-format argument that leads every headline is the least important of the three. Precision in audit prevents chaos in execution, and the audit here says the industry is optimizing the wrong variable.
Here is what matters to anyone holding keys.
Every agent identity product shipping today is, structurally, an API key with better paperwork. In crypto we already ran this experiment and we have the loss data. An ERC-20 infinite approval is a bearer token. It grants an unbounded, non-expiring right to act on your balance, held by a counterparty whose compromise you cannot detect until the balance is gone. An agent holding a bearer credential is an infinite approval with a natural-language interface. The failure mode is identical. The remediation pattern should be identical too: expiry, scope ceiling, and a revocation path that does not require the issuer's cooperation.
On-chain, two of the three layers are already partially answered โ badly, but answered. Session keys give you expiry and scope caps. Account abstraction permission frameworks let a user grant a narrow, revocable capability to an automated actor without surrendering the root key. Paymaster policy lets a sponsor bound what the delegated actor can spend. None of this is elegant, and most of it is chain-specific and unaudited. But it exists, it is live, and it enforces at the execution layer rather than the assertion layer. The EVM shipped agent permissioning before the IETF shipped a charter. That should embarrass the working group more than it does.
The most underweighted fact in the launch cycle is that Microsoft did not implement ID-JAG. Entra Agent ID went GA in April 2026, four months ahead of Okta's August release, and it ships inside existing E5/E7 entitlements at zero marginal cost. Okta's 25-partner alliance โ Anthropic, Zoom, Slack, Cloudflare โ cannot reach the identity inventory that already lives inside Entra. The real map is not two camps. It is three: standard-anchored, protocol-agnostic, and platform-native. The third camp's position is simply that it does not need a standard, because it owns both ends of the connection. Crypto has the same structure. The custodians and the large venues will not wait for a specification; they will extend the wallet they already control and the specification will be retrofitted around their behavior.
The protocol-agnostic pitch deserves scrutiny. MCP's authorization model and A2A's authorization model are not isomorphic. They differ on subject identification, capability declaration, and delegation-chain expression. Accepting arbitrary token formats is trivial. Normalizing two authorization semantics into one policy model is a cross-protocol semantic layer, and describing it as solved is a simplification that will surface as an audit finding in someone's production environment.
Then there is pricing, where the published record is empty. No per-agent rate, no per-token rate, no subscription tier, no free layer across any of the six. That silence is itself a signal. Agent counts will exceed human headcount by an order of magnitude โ the referenced projection is 150,000 agents per Fortune 500 company by 2028 โ and per-identity pricing collapses under that math. The anchor will move to per-policy-evaluation or per-protected-resource. On-chain the equivalent already exists: you price the intent simulation, not the signer. Anyone modeling this as seat-based IAM expansion is modeling the wrong curve.
The layer nobody shipped is capability expression. Current products declare agent capability as a scope string. A tool-using agent's real capability surface โ which functions it can call, which datasets it can touch, which downstream agents it can spawn โ is far more complex than a scope list. There is no capability description language in any of the six products.
I run an agent in production. Through 2026 I have operated a system that cross-references off-chain model sentiment against on-chain liquidity verified through Chainlink, and it places trades against that signal. The model holds a credential. That credential is valid. If the model is prompt-injected, the credential remains valid. The identity system sees a legitimate subject performing legitimate actions, because the identity system authenticates the subject and not the intent. No vendor in this launch cycle has an answer for the legitimate-subject, illegitimate-action problem, and it is the only problem that will actually cost someone money.
Retail reads seven weeks and six launches as market maturity. Smart money reads it as a briefing calendar. Five of six releases inside seven weeks, two on the same day, is conference-season coordination, not convergent demand.
Shipping is not adoption. There is not one deployment scale figure, one paying customer count, one renewal rate in the entire cycle. The single scale number offered โ millions of agents, over a thousand MCP servers โ has no defined unit. Is a single API call an agent? Is a retry an agent? Without a unit, the number is decoration.
The absentees are more informative than the entrants. CyberArk, now inside Palo Alto Networks. HashiCorp Vault. Venafi. And the machine-identity security cohort that dominated 2024 and 2025 funding. None appear in the six. Those are the parties with both the balance sheet and the motive to acquire Descope or Cequence, which means the vendors currently being framed as competitors are more likely acquisition targets than standard-bearers. Precision in audit prevents chaos in execution โ and the audit says the exit is the strategy, not the spec.
The last omission is institutional. Enterprise procurement does not cite RFC numbers. It cites Kantara certification and FIDO certification. The identity profiles that actually clear a security questionnaire โ the FAPI family โ converged at the OpenID Foundation, not the IETF. A finished RFC with no certification program attached is a document, not a purchasing criterion. Crypto learned this the hard way: an EIP number does not clear diligence. A completed audit and a SOC 2 report do.
Watch three markers over the next two quarters. Whether ID-JAG advances from its current revision past Working Group Last Call before the November 22, 2026 expiry. Whether Entra Agent ID attach rates begin showing up as Okta renewal friction. And whether the first machine-identity acquisition closes โ that transaction will tell you more about the real standard than any charter vote.
The forward question is uncomfortable. If a ratified, certified agent identity standard lands in 2028, which of the six vendors will still be holding the credential โ and which will be the credential?