Okta's flagship conference, Oktane, returns September 22–24, 2026 at Caesars Forum in Las Vegas. The tagline this year is blunt: "Agents change everything. See how Okta secures AI." Okta is positioning it as the AI security event of the year, and on the substance, we don't think that's hype — AI agents genuinely do change the identity conversation.
Going into this year's event, Okta has already shipped a lot in this direction. "Okta for AI Agents" registers agents as first-class identities in Universal Directory, with an assigned human owner. Identity Security Posture Management (ISPM) discovers agents an organization didn't know it had. Cross App Access (XAA) — a new protocol extending OAuth and OIDC — standardizes how agents and applications connect to each other. Identity Governance (OIG) layers in audit trails and a kill switch to revoke a rogue agent's access. And Okta has been direct about why: a survey the company commissioned found that 91% of organizations have already deployed agentic AI, but only 10% back that up with governance. That's not a small gap to close.
Two different questions
All of that infrastructure answers one question well: who is this agent, and what is it allowed to connect to? That's identity — a directory entry, a set of credentials, a scope of access granted at provisioning time.
There's a second question that sits right next to it: should this specific agent take this specific action, right now, given what it's actually doing? That's authorization — a decision made in the moment, not at setup time. An agent can hold a perfectly valid identity and a correctly scoped credential and still be about to do something it shouldn't, given its current context, trust level, or the specifics of the request in front of it.
The two questions rhyme, but they're not the same one. Provisioning-time access answers "can this agent reach this system, in general." Runtime authorization answers "should this exact call go through, right now." Both matter. Neither substitutes for the other.
This is the same distinction we've written about before in the context of API keys: they tell you an agent is who it claims to be, but they don't tell you whether the specific thing it's about to do is fine — see why autonomous agents need their own identity infrastructure.
Where the two layers meet
Okta's Cross App Access is a good example of where this gets interesting rather than adversarial. XAA's rollout has featured Anthropic's Claude and MCP as a partner scenario — an identity provider brokering the connection between an agent and the tools it reaches through MCP. That's exactly the boundary we've written about separately: a connection being authenticated and correctly scoped doesn't yet answer whether a particular tool call should be allowed. See MCP needs an authorization layer, too.
That's the shape of how we think identity and authorization fit together generally: identity infrastructure (Okta's directory, XAA's connection brokering) establishes who an agent is and what it can generally reach. An authorization layer sits downstream of that, making the per-action call — check policy, check trust score, check context — and produces a record of the decision either way. AGF's own version of that decision point is /v1/decide: given an agent, an action, and a context, it returns an allow/deny plus a signed decision artifact, so the call is provable after the fact rather than inferred from a log line. We've written about how we think about that trust boundary in three trust zones: a practical model for agent authorization, and about why revocation specifically needs its own model once agents are running: authentication scales, revocation doesn't.
Where this is headed
We expect a lot of what gets announced at Oktane 2026 to keep building out the identity side of this — better discovery, better lifecycle management, broader XAA adoption. That's good, necessary work, and it's not something we're building. Our focus is the layer next to it: the authorization decision itself, agent by agent, action by action.
Authorization layer for the agentic enterprise. Your agents have identities; we give them authorization.
Try it yourself:
- Try our sandbox — no credit card required
- Read our API docs
- Get in touch
Related:
- Three trust zones: a practical model for agent authorization →
- Authentication scales. Revocation doesn't. →
- MCP needs an authorization layer, too →
AGF is an independent authorization platform. This post is for educational purposes and is not endorsed by or affiliated with Okta.