Native agent identity isn't the finish line

Four major announcements landed in the AI identity space this month:

• Okta became a featured identity provider for Claude Enterprise
• 1Password acquired Apono and launched Credential Broker
• WorkOS launched auth.md
• Anthropic published how agent identity works in Claude Tag

Most people are reading these as the same story. They're not.

The industry is treating agent identity as a single question: does the agent borrow a human identity or have one of its own? That's only half the problem. There are actually two axes that matter:

• Whose identity is it? Borrowed or native?
• How scoped is it? Broad and persistent, or narrow and task-specific?

Once you look through that lens, the market starts to separate quite quickly.

We've already lived the borrowed identity problem

We ran into it on a client project before any of these solutions existed. We needed an agent to act on behalf of a user inside a platform that had no concept of agent authentication - it only knew how to authenticate humans.

Our first approach was browser automation. The agent navigated the application through the DOM like a person would. It worked until it didn't. A browser extension injected an extra element into the page and broke the flow. A password manager hint appeared where the script wasn't expecting it. The whole thing became fragile because it depended on the interface never changing shape.

The second approach was credential brokering. The agent never saw the password; access was granted through an intermediary. This was safer and more robust, but fundamentally nothing had changed. The agent was still pretending to be a person - it was just an impersonation with better locks.

Why the recent moves matter

They're all trying to address the same underlying reality: agents need identities of their own. Native identity is progress, but not the destination.

Okta and 1Password are extending systems originally built for humans. They're solving an important problem, but the model is still fundamentally a borrowed identity - the agent acts through access derived from a person.

WorkOS and Claude Tag move to the other side of the line. Instead of asking how an agent can safely borrow a human identity, they ask whether the agent should have its own. That's real progress, but identity isn't the only axis.

Scope is the second axis

The second question is scope: how much access should an agent have? This is where Claude Tag becomes particularly interesting. Anthropic gives Claude its own identity - it has its own service accounts and acts as itself rather than borrowing your credentials. But Anthropic also recommends broad access within a channel so Claude can be useful across the team's workflows. That's understandable from a product perspective.

It's also very different from where agent security may ultimately need to end up. A growing argument in the industry is that agents should start narrow, not broad. Each task gets a fresh identity with the minimum capabilities required to complete that task. Access comes from what you've explicitly handed the agent, not from standing permissions waiting to be used.

Which means the market doesn't look like a single spectrum. It looks more like:

• Okta and 1Password - borrowed identity, broad access
• Claude Tag - native identity, broad access
• The likely destination - native identity, narrow access

That's a much more useful way to understand what's actually happening.

The accountability question nobody has answered

There's another implication hidden underneath all of this. Most security models assume authority ultimately traces back to an accountable individual. "Claude acting on behalf of Bob" is easy to reason about.

But Claude Tag works differently - the identity belongs to the channel and the permissions are administered at the channel level. That's practical for teams, but it raises an interesting question. If an agent's identity belongs to a channel rather than a person, who do you point at when it breaks? Who owns the decision? Who owns the consequence?

That's not a criticism of Claude Tag. In many situations it's exactly the right trade-off. But it's an open question.

Native identity solves impersonation. It doesn't automatically solve scope, and it doesn't automatically solve accountability. Those are the problems worth watching now.