Six Agent Identity Products Shipped in Seven Weeks. The IETF Still Cannot Agree on What an Agent Is.

The data shows five vendors launched agent identity products within a seven-week window between August 24 and October 15, 2026. Okta shipped on August 24. Descope and ServiceNow shipped on the same day, October 15. Microsoft's Entra Agent ID had already been generally available since April. Six vendors, one narrative: the agent identity layer is here, whether or not the standard is. I have audited token exchange implementations since RFC 8693 landed in 2020. When I saw Okta's ID-JAG draft reviewed at 154 supporters for a working group against 38 who backed the proposed charter, I recognized the pattern immediately. This is not a technical problem. This is a semantic problem wearing technical clothes. The market is shipping product into a vacuum, and the vacuum is not an accident. Context first, because the framing matters. ID-JAG — the Identity Assertion JWT Authorization Grant — is not a new cryptographic primitive. Decompose it and you find three known mechanisms stapled together: JWT assertion issuance from RFC 7523, cross-authorization-server token exchange from RFC 8693, and scoped tokens from OAuth 2.1 semantics. What Okta actually built is an extension of the "user to application" SSO model into a chain: user authorizes application, application delegates to agent, agent reaches the target resource. The identity provider signs the start of the chain instead of each individual resource server. That is a valuable engineering convergence. It is not a new trust model. So the honest categorization is combinatorial innovation plus engineering innovation. Nothing more. The real technical work happened between 2014 and 2020 in workload identity — SPIFFE, WIMSE, token exchange. The agent identity products of 2026 are that work repackaged for a new subject type: non-human, autonomous, multi-hop, cross-domain. The standard vacuum narrative is technically correct. The cause of the vacuum is not difficulty. It is that nobody has converged on what an agent's identity actually represents. Here is where my audit diverges from the press coverage. The articles covering this product cycle draw a two-camp map: ID-JAG aligned versus protocol agnostic. That map is wrong, and it is wrong for a specific reason. The real technical split is three layers deep, and none of the six vendors have named these layers in their briefings. The first layer is delegation semantics. How do you express, end to end and auditably, that agent B was delegated by agent A who was acting on behalf of user A, with scope limited to S? ID-JAG solves the token acquisition. It does not solve the semantic compression of multi-hop delegation. No vendor on this list has an answer. The second layer is proof of possession. If the token is stolen, does it still work? Descope is the only vendor in the six that touches this — SPIFFE support plus mTLS binding. Every other vendor is relying on bearer tokens, which means every other vendor has the same exposure it had in 2019. The press release language calls this "further along than Okta's current posture." That undersells it. Descope is the only one answering the fatal weakness directly. The third layer is revocation granularity. Can you revoke one hop in a delegation chain without breaking the whole thing? ServiceNow answered with tiered execution plus a kill switch. The granularity is coarse. But it is the only real answer in the group. These three layers are the actual competitive battlefield for the next eighteen months. The coverage is focused on token formats. Token formats are the least interesting variable in the system. Now the protocol-agnostic position, which deserves more scrutiny than it received. Postman and Cequence are described as offering a governance layer that transcends protocol. The implication is elegance: accept any token format, enforce policy above the mess. Accepting arbitrary token formats is simple. Normalizing MCP authorization semantics and A2A authorization semantics into a single policy model is not. MCP's authorization model is OAuth 2.1 with resource indicators plus enterprise-managed authorization extensions. A2A's model is security schemes declared in the Agent Card, predominantly OIDC and OAuth2. These are not isomorphic on subject identification, capability declaration, or delegation chain expression. "Protocol-agnostic execution" means writing a cross-protocol semantic middle layer — one that translates between two incompatible authorization vocabularies. That is a hard engineering problem. Presenting it as solved is a simplification that will surface as integration friction in the first enterprise deployments. And then the omission that most coverage missed entirely: Microsoft does not implement ID-JAG. Entra ID is the highest-installed identity provider in enterprise. Its absence means ID-JAG cannot become the default standard, no matter how many names Okta puts in a partner alliance. Twenty-five partners do not cover Entra's installed identity base, because Okta's customers are also Microsoft's customers. This is the real structure. Not two camps. Three. Standard anchors: Okta and Descope. Protocol agnostic: Postman, ServiceNow, Cequence. Platform native: Microsoft. And Microsoft's strategy is the ruthless one — it does not need a standard because it owns both ends of the connection. Entra Agent ID went generally available in April 2026, four months before Okta's August 24 launch. It ships bundled into E5 and E7 licensing at zero marginal cost. Okta must sell cross-platform neutrality as a differentiator. Cross-platform neutrality is the least quantifiable value in enterprise procurement. That is a structural trap, not a competitive position. I built a validator monitoring stack in late 2023 that cut bot transaction failure rates by fifteen percent. The lesson generalized: infrastructure efficiency comes from standardized, repeatable processes, not from vendor promises. Agent identity is on the wrong side of that lesson right now. Six vendors, six policy engines, zero interoperability guarantees, and a governance body that cannot agree on what the subject is. Which brings me to the layer that almost nobody is pricing correctly. An agent holding valid credentials, hijacked by prompt injection, appears fully legitimate to every identity system on this list. The credential is real. The delegation is correctly signed. The scope is within policy. The behavior is hostile. This is not an authentication gap. It is an authorization model gap, and it is the one structural risk that no vendor in the six has answered, because answering it requires abandoning the premise that a valid token means a trustworthy actor. Cequence is the only one whose business model rests on agents lying. That sounds like a positioning weakness — a company whose product value goes to zero if agents behave. Look closer and it is a moat. The premise that agents will not always behave is a safe long-term bet. The cost is that Cequence gets classified as a detection tool rather than identity infrastructure, which caps its contract values and strategic value. That trade is worth naming explicitly. Now the commercial reality, because the technical analysis means nothing if nobody pays. Who pays for agent identity? Three candidates, three completely different budget lines. The agent's owner — enterprise IT — pays from the IAM budget, directly competing with Okta and Entra. The agent's operator — the SaaS vendor — pays from cloud costs and is extremely price sensitive, with a structural incentive to build instead of buy. The resource owner — the party being accessed — pays from the API security budget, which is Cequence's territory. Three buyer groups, three budget categories, no single product covering all three. Every vendor in this cohort has picked one and is pretending the others do not exist. That is why I read ServiceNow's position as the most undervalued in the group. ServiceNow AI Passport's differentiation is not AIMS or WIMSE. It is that policy decisions draw on CMDB and GRC. The hardest problem in agent identity is not issuing credentials. It is deciding what an agent should be allowed to touch — and that decision requires an authoritative inventory of assets and dependencies. ServiceNow owns the most complete CMDB in enterprise IT. It does not need to win the standard war because it owns the input side of the policy decision. It is the only vendor in the six that can win without a standard, and every comparison piece has filed it under "second camp." Now the contrarian read, because the consensus narrative has this backwards. The consensus assumes the IETF failure is a delay. It is not a delay. It is a signal that the category as a single standard will not exist. Look at the history of successful identity standards. OpenID Connect succeeded by splitting away from OAuth 2.0 with a narrow scope. SCIM succeeded because it was driven by a single dominant use case — user provisioning. Every successful identity standard in the last fifteen years had a single dominant vendor and a converged use case set. Agent identity's use case set is divergent by construction. A customer service agent, a coding agent, and a financial trading agent have entirely different trust requirements, different threat models, and different audit obligations. A narrow charter is the only path forward, and a narrow charter means the concept of "agent identity standard" fragments into a set of mutually non-subordinate profiles. The number 154 versus 38 is not a governance wrinkle. It is the IETF's most reliable failure precursor. Everybody agrees something must be done. Nobody agrees what. And here is the second omission that matters more than any vendor detail: the real standardization venue for this may not be the IETF at all. Enterprise identity profiles have historically converged at the OpenID Foundation, not the IETF. FAPI did not come out of the IETF. Kantara Initiative owns identity assurance certification. FIDO Alliance owns authenticator certification. When an enterprise actually writes a procurement requirement, it writes "Kantara certified" or "FIDO Certified." It does not write an RFC number. Even if the IETF produces a completed RFC, without a certification program, no enterprise procurement team can buy against it. Coverage of this cycle did not mention OIDF, Kantara, or FIDO once. That is the deepest structural blind spot in the whole conversation. AIMS deserves a flag as well. ServiceNow explicitly states its implementation is based on AIMS and WIMSE rather than ID-JAG. Yet nobody has stated AIMS maturity, ownership, or governance status. If AIMS is a vendor-dominated specification, then ServiceNow's choice is not a technical route — it is a bet on a controllable substitute in a standards contest. That distinction changes the strategic read entirely. Let me put numbers to the absence. Gartner's cited figure for 2028 is an average of 150,000 agents per Fortune 500 company. Per-identity pricing collapses at that scale. No vendor has published per-agent pricing, per-token pricing, subscription tiers, or a free tier. Zero pricing information across six products. I cannot build a unit economics model from zero. What I can say with structural confidence: at 150,000 identities per customer, the pricing anchor will migrate to per-policy-evaluation or per-protected-resource. That is inference from industrial pattern, not verified fact. Treat it as a hypothesis. One more distinction the coverage blurred systematically. Shipping is not adopting. The word in every headline is "shipping." There is not one deployment scale figure, paid customer count, or renewal rate in the entire cycle. Descope's claim of millions of agents and one thousand plus MCP servers is the only scale number in the cohort, and it arrives without a definition. What is one agent? Does one API call count? Without definitions, the number is marketing, not evidence. And the release timing deserves skepticism. Five of six launches inside seven weeks, two on the same day. That pattern matches analyst briefing cycles and conference season far better than it matches synchronized market maturity. Vendors ship product when the calendar demands it, not when the market is ready. My verdict on the cohort. ServiceNow has structural commercial advantage because it owns the policy input layer. Microsoft has structural advantage because it owns both endpoints and bundles at zero marginal cost. Okta holds distribution and alliance assets but faces innovator displacement by a platform owner four months ahead on shipping and bundled into existing licenses. Descope has the most complete technical product — ID-JAG issuance and validation, SPIFFE with mTLS, governance suite — and the smallest distribution, which makes it the most likely acquisition target. Cequence has the most intellectually interesting technical position and the narrowest strategic ceiling. Postman has the API traffic entry point and the hardest normalization problem. Cequence and Postman both face the same terminal risk: their value is captured by whichever platform layer absorbs their function first. Now the absence that reframes the whole competitive set. The six vendors covered here entirely exclude the incumbent machine identity players — CyberArk, now inside Palo Alto, plus HashiCorp Vault and Venafi — and the non-human identity security startups that dominated 2024 and 2025 funding: Astrix, Oasis, Entro, Clutch. These two groups are the most capable and most motivated buyers for Descope and Cequence. Any reading of this market as a six-player field is reading an incomplete ledger. The acquirers are not on the board. They are in the next room. The 2022 Terra collapse taught me the only reliable skill in this industry: define the kill switch before you need it. I liquidated forty percent of my USDT into Bitcoin inside forty-eight hours while peers held and lost everything, because the rules were written before the emotion arrived. Agent identity needs the same discipline. An agent identity system without proof of possession, without revocation granularity, without a declared capability language, and without a bound code integrity check is a kill switch that has never been tested. Every one of the six products is missing at least two of those four. The market is in a chop, and chop is for positioning. The positioning question is not which vendor wins the standard. There will be no single standard for at least three years, and probably never as a unified spec. The positioning question is which layer of the stack becomes the policy decision point, because whoever owns the policy decision owns the pricing anchor, and whoever owns the pricing anchor owns the category. Six vendors shipped. Zero interoperability guarantees. Still no agreed definition of what an agent is. The IETF vote was 154 to 38 on whether to form a working group, which means the industry agrees on the existence of the problem and disagrees on every property of the solution. Audit the logic before you trust the label. Six products labeled agent identity are, on inspection, three extension packages for existing IAM products, two cross-protocol governance layers with unsolved normalization problems, and one credentials platform with a detection business model attached. None of them are a trust model. Liquidities trapped in code, not in trust — and the code here is still being negotiated. The question worth sitting with: when every agent in your estate holds a perfectly valid token and the identity provider has no mechanism to distinguish a delegated action from a hijacked one, what exactly have you purchased? The vendor will call it agent identity. The ledger will call it a bearer token with better branding. Efficiency is the only honest validator. Six vendors have not yet been validated by anything but their own press releases.