Identity Management for Agentic AI [pdf] (2025)

What it is

A 28-page OpenID Foundation whitepaper (Oct 2025) structured in two halves: Section 2 catalogs which existing standards already cover agent auth today, Section 3 scopes out the unsolved problems. The existing summary already captures the problem list from Section 3. What it omits is the concrete Section 2 guidance — the specific standards mapping and named working groups an implementer would actually go use today.

What to do

The paper's actionable layer, not covered in the summary:

• MCP's auth evolution: the protocol's initial spec shipped with no authentication; later revisions added it. Anyone integrating MCP should check which spec version they're building against rather than assume auth was there from the start.
• Dynamic Client Registration is called out as a distinct, necessary mechanism for agents (Section 2.5) — relevant because agents proliferate client instances in a way traditional OAuth clients don't, and manual client registration doesn't scale to that.
• Asynchronous authorization gets its own section (2.7) as a gap area even within "solved" single-domain cases — i.e., OAuth 2.1's synchronous consent flow doesn't map cleanly even for agents operating in one trust domain if they act after the user has left the loop.
• IPSIE (Interoperability Profiling for Secure Identity in the Enterprise) is named as the specific working group producing interoperable profiles for enterprise AI agent conformance — a concrete pointer for enterprise security leads who want to track or contribute to standards work rather than wait for a finished spec.
• The paper explicitly scopes out web-search and computer-use agents from its core analysis (treating them as "important but out of scope"), even though the executive summary flags browser/computer-use agents as breaking the authorization paradigm — so readers looking for a treatment of that specific problem won't find depth here, just a flagged gap.

Caveats

This is Section 1-2 territory only (pages 1–9 of the fetched text); the document's actual proposed solutions for the Section 3 hard problems (delegation chains, team-based agents, etc.) aren't in the fetched content, so this analysis can't confirm whether the paper offers concrete mechanisms there or only frames the open questions.