As autonomous AI agents shift from chatting to executing multi-step workflows, calling tools, and transacting on our behalf, the traditional security perimeter is breaking down . We are moving from a web of human-authenticated sessions to an agentic web , where software acts as the primary user.

Securing this shift requires solving three core pillars: Identity (who/what is this agent?), Trust (is it authorized and bound to a verified human/organization?), and Authentication (how does it securely access APIs and data without leaking secrets?).

Several specialized startups and emerging platforms are defining this space:

• • Aembit : Focuses heavily on Identity and Access Management (IAM) for Agentic AI and non-human workloads. Aembit provides secretless authentication and enforces policy-based, short-lived access when AI agents connect to enterprise resources, cloud services, and data platforms like Snowflake. They feature centralized policy enforcement and integrations with tools like the Model Context Protocol (MCP) to ensure agents only touch what they are explicitly authorized to access.
• • Truvera (by Dock Labs): Tackles portable agent identity and agentic commerce. Truvera Agent ID issues W3C-compliant verifiable digital credentials that cryptographically bind an AI agent to a verified human or parent organization. It manages delegated-authority credentials (defining exact permissions) and integrates directly into agent workflows to allow instant, auditable, and privacy-preserving verification across ecosystems.
• • Descope / Auth0 (Developer-focused IAM): While broad customer identity platforms, they have adapted significantly for developer ecosystems building agentic applications. They provide the primitives needed to handle delegated user tokens so that when an agent acts "on behalf of" a user, the application maintains strict session boundaries and doesn't grant the LLM standing, unbounded access.
• • Enterprise Giants (For Context) : While not traditional startups, platforms like Microsoft Entra Agent ID and specialized security plays like CyberArk (for privileged agent access) are racing to define enterprise boundaries, often dictating the integration standards that startups must interoperate with.

If you're exploring this space for a specific use case, let me know:

• Are you building consumer-facing agents (agentic commerce/payments) or enterprise internal agents?
• Do you need help with cryptographic verification (W3C credentials) or API-level secretless auth?

I can dive deeper into the specific architecture you might need.

Yes. The interesting market is emerging around a shift from “authenticate the human” to “authenticate the agent, its principal, its authority, and the action.”

I’d divide the startups into roughly five layers:

1. Agent identity + delegated authorization

These are probably the closest to what you mean by “agents are users.”

• proof.com — One of the most interesting pure-play bets. Its x401 protocol lets a website/API request cryptographic proof of who authorized an agent and what claims that authorization carries—identity, organizational affiliation, signing authority, age, etc.
• auth0.com — Incumbent rather than startup, but strategically important. Auth0 now explicitly treats the agent as a principal, with agent identities, token vaults, MCP authorization and fine-grained authorization.
• Stytch — Building agent-oriented OAuth/delegated authorization on top of its developer identity infrastructure.
• Descope — Extending identity flows and authorization toward agents and non-human actors.
• Frontegg — Particularly interesting for SaaS platforms that need to let customers' agents access their products.

A useful way to think about this category is:

Human → authorizes agent → agent receives bounded authority → service verifies agent + principal + scope → action is auditable. That is fundamentally different from giving an LLM a user's API key.

2. Agent registries / reputation / “who is this agent?”

This is a more nascent category, and potentially the most interesting if you're thinking about an open Internet of agents rather than enterprise IAM.

• Astrasync AI — Building an identity layer around agent registration, verification and trust scoring.
• Keycard — Focused on access infrastructure, dynamic credentials and federated identity for trusted AI agents.
• TessIndex — More experimental/research-oriented, but conceptually fascinating: persistent agent identities linked to ownership, capabilities, verification and reputation.

The missing primitive here is something like:

Agent passport = identity + owner + provenance + capabilities + reputation + current authorization.

That's much closer to a driver's license / business registration than today's API token.

3. Identity verification and “proof of the principal”

This becomes crucial when an agent crosses into the real economy.

• withpersona.com — KYC/KYB infrastructure that can become the identity-verification substrate underneath agent transactions.
• prove.com — Explicitly repositioning identity verification as a persistent trust layer for people, businesses and AI agents.
• socure.com — Another important player because identity/fraud infrastructure becomes increasingly valuable when agents can transact autonomously. Its latest move is particularly telling: Socure is incorporating AI-driven automation into its fraud/risk platform as agentic systems increase the identity problem.

The key question these companies answer isn't merely:

“Is this agent legitimate?”

It's:

“Is there a real, verified entity behind this agent, and did that entity authorize this action?”

4. Non-human identity + secrets + runtime access

This is the enterprise-security version of the problem.

Some of the startups here are less “agent identity companies” and more machine identity / workload identity companies being pulled toward agents.

• Keycard
• Archestra — Agent security gateway with access control and runtime guardrails.
• Token Security / Token2
• Silverfort — Particularly relevant around identity-based security for non-human identities.
• Astrix Security — Important adjacent category: machine identities, secrets and non-human access.

The underlying realization is that an AI agent isn't just another application. It can dynamically acquire credentials, call APIs, delegate to other agents and potentially operate for hours without a human watching it.

So credential lifecycle becomes agent lifecycle.

5. Agentic commerce: identity → authorization → money

This may ultimately be the biggest commercial manifestation.

The emerging stack looks something like:

Person → Agent → Verified identity → Authorization → Payment credential → Merchant → Settlement

That's why companies like Stripe, Visa, Mastercard and Cloudflare are suddenly building agent-specific payment/identity primitives. The core problem isn't technically “can an agent buy something?”—it's how does the merchant know which person authorized the purchase and what the agent was permitted to do?

Cloudflare's move is particularly interesting because it combines agent identity + wallet + spending controls, effectively treating the agent as an economic actor with bounded financial authority.

---

The startups I'd watch most closely

If I were making a 2026 watchlist specifically for “the web where agents are users,” I'd start with:

1. Proof — strongest thesis around proof of authority behind an agent.
2. Auth0 — potentially enormous distribution if agent identity becomes an extension of mainstream IAM.
3. Keycard — interesting bet on agent-native access/credentials.
4. Astrasync AI — interesting bet on an actual agent identity/trust network.
5. Prove — strong position at the human/business ↔ agent boundary.
6. Archestra — runtime enforcement/security rather than just identity.
7. Persona — important if agents increasingly transact on behalf of verified people/businesses.
8. Stytch / Descope / Frontegg — developer-facing identity platforms that can absorb the agent transition.

And I'd put Stripe, Visa, Mastercard, Cloudflare and Okta in a separate category: not startups, but potentially the biggest infrastructure incumbents competing to own pieces of this layer.

The bigger thesis

I think the eventual identity stack looks less like today's:

User → login → session and more like:

Principal → agent identity → delegation → capability → transaction → cryptographic evidence The really valuable primitive is therefore not simply “agent authentication.”

It's verifiable agency:

Who is responsible for this agent? What exactly was it authorized to do? Who delegated that authority? What did it actually do? And can another party independently verify all of that? That's why Proof's x401 is particularly notable: it is attacking the authorization provenance problem rather than merely putting OAuth in front of an LLM.

And the research literature is converging on essentially the same missing pieces: persistent agent identity, capability verification, delegation, trust negotiation and accountability.

If you're evaluating this as a startup/investment landscape, I'd actually map these companies on a 2×2 of human↔agent identity vs. agent↔agent trust, because there is a surprisingly large white space in the upper-right quadrant.

If by “the web where agents are users” you mean a world in which an AI agent can log in, delegate authority, buy things, access data, call APIs, and act on behalf of a person or company, I’d split the startup landscape into a few layers.

The interesting shift is that authentication (“who are you?”) is becoming only one piece. The harder questions are: who authorized you, what are you allowed to do, what are you allowed to spend, and can the relying party verify all of that? Recent industry work is explicitly converging on those questions.

The companies I’d watch

• Proof — Probably one of the most directly aligned with your thesis. Proof is building identity/authorization infrastructure around the principal behind an AI agent, rather than treating the agent as an isolated credential. Its new x401 protocol lets a website/API request cryptographic proof of things such as identity, age, organizational affiliation, signing authority, or authorization.
• Stytch — The incumbent/startup crossover I’d watch most closely. Stytch is explicitly positioning itself as an identity layer for humans and AI agents, covering authentication, authorization, consent, MCP authentication, agent detection, and machine-to-machine auth.
• Token Security — More enterprise-security-oriented: its thesis is essentially that AI agents are identities, and therefore need identity-first security rather than being treated merely as another application. It was highlighted among notable private cybersecurity startups in 2026.
• Astrasync AI — A particularly interesting pure-play direction: a universal identity layer for agents involving registration, verification and trust scoring. That's much closer to an eventual “DNS + reputation + identity” layer for agents than conventional workforce IAM.
• Obsidian Security — Not agent-native identity from scratch, but increasingly important because it sits at the intersection of identity, SaaS permissions and AI-agent activity. It raised at a $1.1B valuation in August 2026 amid demand to secure agents accessing enterprise data.
• Saviynt — The enterprise IAM side of the same transition. Its new Zuma platform is explicitly aimed at discovering, governing and controlling AI agents and other non-human identities.

But there's an even more interesting frontier

I'd distinguish agent identity from agent trust.

A useful architecture looks something like:

Human / organization ↓ delegates authority ↓ Agent identity ↓ verifiable capabilities + permissions ↓ specific transaction/action ↓ audit trail + reputation

The startups above occupy different points on that stack.

The really valuable primitive may ultimately be a portable, verifiable delegation credential: “Agent X is acting for Principal Y, under authorization Z, with these constraints, and this authorization hasn't been revoked.”

That is substantially more useful than simply giving an agent an OAuth token.

The “agent passport” category

Proof is particularly interesting here because x401 is explicitly attacking the missing link between an agent and the authority behind that agent.

Astrasync is interesting from the complementary direction: what is this agent, has it been verified, and should I trust it?

And Stytch is attacking the practical application layer: how does my website authenticate, authorize, consent, throttle and revoke these agents?

That gives you a rough emerging stack:

One important wrinkle: the biggest winners may not look like identity startups today. Payments companies, browsers, API gateways, cloud IAM vendors and commerce platforms all have a natural claim on this layer. The emerging agentic-commerce battle is already being framed around authorization, agent-specific credentials and proof of user intent.

My short list

If I were building a 2026 landscape map and wanted the 5 names most worth studying deeply, I'd start with:

1. Proof — proof of authority / delegation
2. Stytch — agent authentication + authorization
3. Astrasync AI — agent identity + reputation
4. Token Security — identity security for autonomous agents
5. Obsidian Security — enterprise control plane for agent identities

And I'd keep Saviynt in the “large incumbent that could become enormous in this category” bucket.

The underlying startup opportunity is bigger than “AI auth.” It is arguably the identity layer for machine-to-machine society: persistent identity, delegation, capability, reputation, payment authority and accountability for software that can act without a human clicking every button. Recent research is independently converging on persistent agent identity and verifiable capability as missing infrastructure, which is a good signal that this is becoming a real protocol layer rather than merely an IAM feature.

That is substantially more useful than simply giving an agent an OAuth token.

The “agent passport” category

Proof is particularly interesting here because x401 is explicitly attacking the missing link between an agent and the authority behind that agent.

Astrasync is interesting from the complementary direction: what is this agent, has it been verified, and should I trust it?

And Stytch is attacking the practical application layer: how does my website authenticate, authorize, consent, throttle and revoke these agents?

That gives you a rough emerging stack:

One important wrinkle: the biggest winners may not look like identity startups today. Payments companies, browsers, API gateways, cloud IAM vendors and commerce platforms all have a natural claim on this layer. The emerging agentic-commerce battle is already being framed around authorization, agent-specific credentials and proof of user intent.

My short list

If I were building a 2026 landscape map and wanted the 5 names most worth studying deeply, I'd start with:

As autonomous and semi-autonomous AI agents transition from chat-based assistants to active digital workers—reading emails, querying production databases, executing code, and transacting via APIs —the traditional web identity stack is breaking down.

Human identity models (OAuth tied to a person, session cookies, passwords) and static machine identities (hardcoded API keys, over-privileged service accounts) cannot handle workflows where an agent dynamically chains tools at machine speed.

A specialized ecosystem of startups and platforms has emerged to define Agentic Identity and Access Governance (AIAG) , treating AI agents as first-class, accountable actors on the web.

1. Dedicated Agentic Identity & Control Planes

These startups focus specifically on giving non-human agents a cryptographic or managed identity, scoping their permissions, and acting as a runtime proxy for verification.

• Agentic Fabriq (YC W26) : Positioned as an "Okta for Agents," Fabriq sits in the middle of an agent's execution loop. It intercepts agent-to-tool calls to handle identity propagation, enforce scoped permissions, inject real-time approval flows, and log verifiable compliance audit trails so organizations don't have to rely on shared API keys.
• Linx Security : Specializes in Agentic Identity Governance . Linx builds a continuous identity graph that maps AI agents alongside human and non-human identities (NHIs). It tracks "access policy drift"—detecting when an agent’s dynamic tool-use permissions widen beyond what was originally authorized or intended by its owner.

2. Non-Human Identity (NHI) & Access Management Specialists

Because AI agents interface with internal resources via Non-Human Identities (tokens, MCP servers, OAuth grants), specialized NHI security startups have rapidly expanded their scopes to cover agentic trust.

• Astrix Security : Extends its core non-human identity platform to cover AI agent platforms (such as OpenAI/ChatGPT Enterprise, Microsoft Copilot Studio, and Gemini) and Model Context Protocol (MCP) servers. Astrix focuses on securing the underlying IAM permissions and OAuth connections that agents leverage to touch enterprise data.
• Entro Security : Provides posture management and authentication hierarchy enforcement for machine and agent identities. They focus on locking down how agents authenticate across SaaS integrations, advocating for short-lived OAuth 2.1 tokens and preventing long-lived secrets from ever sitting on unmanaged endpoints.
• Oasis Security : Focuses on the lifecycle management of non-human identities, providing discovery, automated remediation, and governance frameworks that now encompass autonomous LLM agents.

3. Agent Runtime Security & Posture Guardrails

While identity answers "who is this agent and what is it allowed to touch?" , runtime posture startups ensure the agent isn't being manipulated or going rogue mid-task.

• Zenity & Aim Security : Function as governance and runtime security layers that inspect what low-code/pro-code agents are building and executing, ensuring prompt-injection attacks don't hijack an agent's authenticated session.
• Aurascape : Formulates specialized security and visibility frameworks designed around emerging agent communication standards like the Model Context Protocol (MCP), which is quickly becoming the default conduit for agent-to-tool interactions.

Key Architectural Shifts Defining the Space

If you are looking at how these startups are architecting trust for an agent-led web, they generally reject traditional boundaries in favor of three principles:

1. Dynamic Scoping over Static Roles: Unlike a service account meant for a single database query, agent identities require context-aware, task-bound permissions that expire the moment the multi-step task finishes.
2. The Proxy Control Plane: Trust is verified per-call (echoing Zero Trust) rather than per-connection. Startups like Agentic Fabriq act as intermediaries to validate that the human's delegated authority matches the specific agent's immediate action.
3. Standardization around OAuth 2.1 and MCP: The industry is converging around short-lived tokens and protocol-level introspection (such as managing MCP server interactions) rather than inventing entirely proprietary authentication schemes.

If you're exploring this space technically or commercially, would you like to dive deeper into how Model Context Protocol (MCP) impacts agent authentication , or look at how legacy IAM providers (like Okta or Microsoft Entra) are responding to these startups?

As AI agents transition from experimental chat interfaces to autonomous actors that browse the web, invoke tools via the Model Context Protocol (MCP), execute APIs, and complete financial transactions, the foundational assumption of the internet breaks: traditional IAM (Identity and Access Management) was built for static machines or authenticated humans, not continuous, reasoning software.

Securing this "agentic web" requires new primitives—moving away from static API keys and over-privileged service accounts toward delegated authority chains, ephemeral runtime tokens , and verified human-owner binding.

A distinct group of startups and specialized platforms are defining this new stack for identity, trust, and authentication:

1. Non-Human Identity (NHI) & Agentic Workload Security

These companies focus on discovering, mapping, and issuing dynamic, short-lived credentials to autonomous software agents and preventing credential abuse or lateral movement across toolchains.

• •   - [Aembit](https://aembit.io/blog/10-identity-security-vendors-for-ai-agents-strengths-tradeoffs-and-how-they-fit/) : Provides workload IAM and cryptographic identity for agents, issuing short-lived, scoped credentials on-demand to replace hardcoded secrets and standing access when agents call backend systems.[](https://aembit.io/blog/a-catch-up-guide-to-authentication-for-agentic-ai/) [[1]](https://aembit.io/blog/a-catch-up-guide-to-authentication-for-agentic-ai/)
    

• •   - [Entro Security](https://entro.security/) : Focuses on Non-Human Identity Detection and Response (NHIDR), tracking secrets, mapping agent lineages to cloud and SaaS tools, and continuously monitoring agent behaviors for anomalies.[](https://entro.security/) [[1]](https://entro.security/)
    

• •   - [Agentic Fabriq](https://www.ycombinator.com/companies/industry/identity) : A YC-backed startup providing a dedicated control framework to manage what AI agents can access across business tools, applying per-agent identities, scoped permissions, and audit logs.[](https://www.ycombinator.com/companies/industry/identity) [[1]](https://www.ycombinator.com/companies/industry/identity)
    

2. Human-Bound & Verified Agent Identity

For high-stakes actions, e-commerce, or financial transactions, knowing an agent's technical signature isn't enough; systems need to verify the intent and identity of the human owner standing behind the autonomous workflow.

• •   - [Incode](https://www.incode.com/use-cases/agentic-identity/) : Pioneered dedicated *Agentic Identity* capabilities that bind an autonomous agent to a verified human owner via deepfake-resistant biometrics, issuing cryptographic intent tokens with programmable expirations.[](https://www.incode.com/press/incode-launches-agentic-identity-to-verify-and-secure-ai-agents) [[1]](https://www.incode.com/press/incode-launches-agentic-identity-to-verify-and-secure-ai-agents)[[2]](https://www.incode.com/blog/incode-launches-agentic-identity)
    

• •   - [Vouched](https://www.vouched.id/learn/agentic-ai-identity-verification-startup-vouched-gets-17m-to-build-trust-in-autonomous-agents) : Builds proprietary heuristics and detection layers (such as *Agent Shield* ) to help website and application operators differentiate between human users and autonomous agents, assigning session visibility and tracking what actions agents perform on consumer surfaces.[](https://www.vouched.id/learn/agentic-ai-identity-verification-startup-vouched-gets-17m-to-build-trust-in-autonomous-agents) [[1]](https://www.vouched.id/learn/agentic-ai-identity-verification-startup-vouched-gets-17m-to-build-trust-in-autonomous-agents)
    

3. Real-Time Governance & Agent Trust Frameworks

These platforms act as real-time policy enforcers, intercepting tool execution and API calls to ensure agents do not drift outside designated business or security parameters.

• •   - [SecureAuth](https://secureauth.com/newsroom/govern-ai-agent-identities-real-time) : Launched the *Agent Authority Platform* alongside its public *Agent Trust Registry* , providing real-time zero-trust runtime control over agent actions, intent-scoped delegation limits, and instant quarantine protocols if an agent behaves anomalously.[](https://www.humansecurity.com/learn/blog/agentictrust-govern-ai-agents/) [[1]](https://www.humansecurity.com/learn/blog/agentictrust-govern-ai-agents/)[[2]](https://secureauth.com/newsroom/govern-ai-agent-identities-real-time)[[3]](https://secureauth.com/products/agent)
    

• •   - Enterprise giants and developer platforms like [Auth0 for AI Agents](https://auth0.com/ai) and [Teleport](https://goteleport.com/) are aggressively extending their ecosystems with features like *Token Vault* for managed OAuth tool delegation, *Async Authorization* for human-in-the-loop approvals, and hardware-rooted ephemeral privileges for MCP tooling.[](https://goteleport.com/) [[1]](https://goteleport.com/)[[2]](https://auth0.com/blog/introducing-auth0-for-ai-agents/)
    

Would you like to explore how these platforms handle a specific protocol like Model Context Protocol (MCP) security, or are you looking at this from an inbound consumer-facing vs. internal enterprise perspective?

Yes. The interesting thing in 2026 is that “agent identity” is splitting into several different markets. The winners may not be the companies building another login system; they may be the ones that establish the primitives for delegation, provenance, runtime authorization, and counterparty trust.

My current map:

The ones I'd watch most closely

1. Proof — if you mean “identity for the open Web.”

This is the most conceptually ambitious. Its x401 protocol is analogous to x402's role for payments: an HTTP-native challenge in which a server can say, essentially, “prove the identity/authority behind this agent before I let you proceed.”

The interesting primitive isn't authentication by itself. It's the chain:

human → authorization mandate → agent → action → verifiable record

Proof's implementation uses Verifiable Credentials, OpenID4VP and scoped delegation.

If x401—or something structurally similar—becomes ubiquitous, it could become a fundamental Web primitive rather than merely another IAM product.

2. Keycard — if you mean “identity + authorization inside enterprises.”

Keycard's thesis is that the unit of authorization isn't:

user → application

but:

user + device + agent + task → specific action

It then issues ephemeral credentials for that action and records the result. That's a very strong model for coding agents, MCP servers and multi-agent systems.

3. NewCore / Oak — if you mean “the next enterprise IAM.”

These two are attacking the bigger organizational problem.

NewCore says essentially: stop treating agents as weird service accounts; make them first-class identities alongside employees.

Oak is taking an even broader “identity operating system” position, building a graph across human, machine and AI-agent identities.

The enormous funding going into this category is a signal: NewCore alone emerged with $66M, while Keycard has $38M and Oak has reportedly raised $60M.

There's also a crucial second category: the incumbents

I wouldn't analyze this market as “startups versus Okta.” The existing identity vendors are moving very quickly.

• Stytch is probably the most developer-native example, with OAuth/OIDC, MCP authentication, consent, agent detection and token lifecycle management. It is now part of Twilio rather than an independent startup.
• Auth0/Okta are extending OAuth and identity infrastructure toward agent-specific authorization.
• Descope is extending its CIAM platform into agents/MCP.
• Ory launched Talos specifically for dynamic, revocable credentials for non-human identities and agents.
• Akamai is building a “Know Your Agent” security layer that binds agents to authorized human users.
• Cisco/Duo is making agents first-class identities with lifecycle, authorization and audit.

So the startup opportunity is increasingly not “build OAuth again.”

The deeper architecture

I think the emerging stack looks something like this:

1. Agent identity
What software is this? What runtime/operator does it belong to?
→ Keycard, NewCore, Oak, Clerk

2. Principal/delegation identity
Which human or organization is ultimately responsible for it?
→ Proof, Clerk, NewCore

3. Authentication / attestation
Can I cryptographically establish that this really is that agent/runtime?
→ workload identity, mTLS, Web Bot Auth, OAuth extensions

4. Authorization
What is this agent allowed to do right now?
→ Keycard, Arcade, NewCore, Willow

5. Counterparty trust
Should my website/business trust this particular agent?
→ Proof, Skyfire, KYA systems

6. Accountability / provenance
Can I prove who authorized an action after the fact?
→ Proof, Keycard, enterprise IAM platforms

7. Economic identity
Who is allowed to spend, receive money, sign contracts, or incur liability?
→ Skyfire, t54, payment networks

And this is why I think authorization is ultimately more important than authentication. An authenticated agent with excessive authority is still dangerous. The hard problem is preserving a chain of authority as an agent delegates to sub-agents, invokes tools, crosses organizational boundaries, and acts autonomously.

That's also where the emerging protocols matter. MCP is largely about agent ↔ tool, A2A about agent ↔ agent, while emerging identity work is trying to answer “who is behind this agent and what authority travels with it?” The OpenID Foundation's agent-identity work explicitly frames authentication, authorization, workload identity and delegated authority as the unresolved architectural questions.

My short list

If I were building an investment/competitive landscape today, I'd put these in the highest-conviction watch bucket:

Proof → Keycard → NewCore → Oak → Clerk → Skyfire → Arcade

with very different theses:

• Proof: identity for the open agentic Internet
• Keycard: authorization for agent execution
• NewCore: the IdP for an agentic enterprise
• Oak: the identity graph / operating system
• Clerk: developer adoption of agent identity
• Skyfire: identity at the commerce boundary
• Arcade: fine-grained authorization for agents

The really interesting question is which of these becomes a protocol/network rather than a SaaS product. That distinction could determine who actually defines the “trust layer” of the agent Web.

The transition from a web of human-driven clicks to an ecosystem where autonomous AI agents act as primary users has broken traditional Identity and Access Management (IAM). Standard IAM expects static user logins, predictable request-response cycles, and single-tenant boundaries . Agents, by contrast, operate continuously, make non-deterministic runtime decisions, jump across third-party APIs via protocols like the Model Context Protocol (MCP), and chain multi-agent workflows.

A dedicated class of startups and infrastructure providers has emerged to solve this Agentic Identity Crisis by building specialized control planes, authentication brokers, and delegation frameworks.

1. Agent-Native Authorization & Connector Gateways

These companies sit in the middle of agent-to-tool interactions, transforming chaotic N -to- N tool integrations into a unified hub-and-spoke control plane that handles delegated OAuth and short-lived tokens.

• Scalekit : Positioned as an authentication and authorization layer for AI agents, Scalekit acts as a secure proxy between agents and enterprise tools (like Salesforce, HubSpot, or Gmail). It manages delegated OAuth flows, operates an isolated token vault, and uses virtual MCP servers to scope an agent's permissions by exact task and purpose, preventing an agent from holding overbroad privileges.
• Agentic Fabriq : Often described as "Okta for agents," this Y Combinator-backed startup provides an organizational control plane for data permissioning. It ensures that when an employee deploys or utilizes an internal agent, the agent is cryptographically bound to that user’s precise data permissions and approval workflows—eliminating the need for shared API keys or static service accounts.

2. Workload & Multi-Protocol Identity for AI

Unlike human users, an AI agent might touch an LLM via an API key, an internal microservice via mTLS, a cloud database via a managed identity, and a SaaS app via an MCP token—all within a single execution step. These startups treat agents as complex, multi-protocol workloads.

• Aembit : Provides Workload Identity and Access Management specifically adapted for agentic AI. Aembit enforces secretless, policy-based, short-lived authentication by creating "blended identity policies". It links every downstream MCP or API request back to both the authenticated human user and the specific authorized agent, ensuring compliance tracking without exposing standing credentials.

3. Non-Human Identity (NHI) & Intent-Based Security

Because agents authenticate using machine credentials, they function as non-human identities (NHIs). These platforms discover "shadow agents" and govern their lifecycles.

• Token Security : Focuses on end-to-end AI agent identity lifecycle governance. Token automatically discovers AI agents and MCP servers across enterprise systems, correlating them into a unified identity graph. Rather than relying solely on post-hoc prompt guards, Token enforces intent-based least-privilege access , evaluating an agent’s real-time runtime behavior against its stated operational purpose.

The Emerging Architectural Playbook

These startups are actively helping the ecosystem converge around open standards to handle "On-Behalf-Of" (OBO) delegation:

• Triple-Identity Tracking : Standardizing tracking for the human principal (sub), the initiating client application (azp), and the acting agent (act) inside JWT/OAuth tokens.
• Agent-Native Discovery : Emerging specifications like WorkOS's auth.md allow agents to dynamically discover how to register, authenticate, and request token scopes cleanly within autonomous loops.

Would you like to explore how these startups handle multi-agent delegation chains (e.g., a primary orchestrator delegating sub-tasks to specialized worker agents), or are you looking at this from a developer integration vs. enterprise governance perspective?

If you mean “who is building the identity/authentication layer for an Internet where software agents—not just humans—are principals?”, I’d watch a fairly small group. The important distinction is that this is broader than “AI security”: the emerging stack needs to answer who is the agent, who authorized it, what is it allowed to do, and can the counterparty verify all of that?

The startups I’d watch most closely

And then there are incumbent-adjacent startups/platforms worth watching, especially WorkOS, which is working through the credential question for agents acting on behalf of users, and Descope/Curity/Frontegg, which are adapting conventional identity primitives to agents.

My mental map of the emerging stack

I wouldn't think of this as one “agent authentication” market. I think there are four layers emerging:

1. Identity — “Who/what is this agent?”
Agent identity, workload attestation, persistent identifiers.

2. Delegation — “Who is behind it?”
A cryptographically verifiable chain:

human → authorization → agent → action

This is where Proof/x401 is particularly differentiated.

3. Authorization — “What may it do?”
Task-, resource-, user-, time-, amount- and context-scoped permissions. Keycard and Aembit are especially interesting here.

4. Trust / accountability — “Should I accept this action?”
Reputation, verified claims, audit trails, behavioral signals, fraud detection and ultimately cryptographic evidence.

That last distinction is important: authentication alone doesn't solve the agent problem. An authenticated agent can still be compromised, manipulated, or overprivileged. Recent research is already finding attacks that can manipulate web agents into initiating login flows, illustrating why “who are you?” and “should I trust this particular action?” have to be separate questions.

The really interesting battle

I think the biggest strategic question is whether the winning primitive looks like:

OAuth token:
user → agent → API

or something more like:

Verifiable delegation:
verified human → signed mandate → identified agent → scoped action → verifiable receipt

The second model is much closer to a web where agents are first-class economic actors. Proof is explicitly betting there, while Keycard/Aembit are attacking the enterprise execution side of the same problem.

And that's why x401 is particularly interesting: it attempts to turn identity from something established during login into something that travels with the agent's individual transaction.

If I were making a 2026 “agent identity infrastructure” watchlist, my top tier would therefore be Proof, Keycard, Aembit, and Stytch, with Archestra as the runtime-security wildcard and Astrasync as the more speculative portable-identity/reputation play.

If you mean startups building the identity/trust primitives for an Internet where an AI agent—not a human browser—is the principal, I’d watch a fairly tight group. The important distinction is between “AI security” broadly and companies actually solving who is this agent, who authorized it, what may it do, and can the counterparty verify that?

The companies I’d put at the top of the map

But I think there are four different identity markets hiding here

1. “Who is behind this agent?” — Proof, Persona, Skyfire

This is the most fundamental change. A normal web request says, essentially, “here are my cookies/API credentials.” An agentic request needs to say:

This agent represents Alice / Acme Corp; Alice authorized it to do X; authorization is still valid; and here is cryptographic evidence.

Proof's x401 is particularly notable because it tries to make that a protocol-level property of HTTP, analogous to how x402 makes payment a protocol-level property.

2. “What is this agent allowed to do?” — Arcade, Stytch, Pomerium

This is authorization rather than authentication.

The interesting primitive isn't merely:

Agent = Alice

but:

Agent = Alice + shopping-agent + <$500 + Amazon/Delta + expires 6pm

That distinction is becoming critical. Microsoft describes the agent identity problem similarly in terms of authentication, delegation, scoped permissions, policy enforcement and auditing.

3. “Can I trust this agent/counterparty?” — Skyfire, t54, Token Security

This is where identity becomes reputation and risk.

A future service may not merely ask “is this agent authenticated?” It may ask:

• Who owns it?
• How long has it existed?
• What model/runtime is it running?
• Has it behaved maliciously?
• What permissions does it possess?
• Has it successfully completed 10,000 similar transactions?
• Is its owner verified?
• Is this particular transaction anomalous?

That is much closer to a credit bureau / certificate authority / fraud network for agents than today's login infrastructure.

4. “Can the identity travel with the agent?” — open protocols

This is the really consequential layer.

The Linux Foundation announced the Agent Name Service (ANS) in June 2026, explicitly aimed at portable identity, verification and discovery for agents across the Internet.

And Proof's x401 is explicitly issuer-neutral: the idea is that a service can request a credential and accept compatible proofs rather than forcing every agent onto one identity provider.

That suggests the eventual stack may look something like:

Human / organization
↓
verifiable identity
↓
delegation mandate
↓
agent identity
↓
scoped capabilities
↓
runtime / behavioral trust
↓
signed action
↓
merchant / API / another agent

My “watch most closely” ranking

If I were tracking this as an investment/technology landscape rather than simply compiling vendors:

Tier 1 — potentially foundational

1. Proof — identity/delegation protocol
2. Skyfire — agent identity + payments
3. Stytch — developer authentication infrastructure
4. Arcade.dev — authorization/capability layer

Tier 2 — enterprise control plane 5. Token Security 6. Pomerium 7. Persona

Tier 3 — agentic commerce / financial trust 8. t54 9. Kite

And I'd watch the standards layer at least as closely as the startups. OAuth-for-agents, OpenID4VC, FIDO's agentic-authentication work, x401, x402, Google's AP2, Visa's agent protocols, and the Linux Foundation's ANS are competing to define the interfaces these companies ultimately have to plug into. The Linux Foundation's ANS announcement is especially significant because it frames agent identity as Internet infrastructure rather than another SaaS IAM feature.

The deepest startup opportunity, in my view, isn't simply “Okta for AI agents.” It's a new trust fabric where an agent can carry portable evidence of identity + authority + provenance + reputation, and where a counterparty can make an instantaneous decision about whether to let that agent act.

That's a substantially bigger category than authentication.

As autonomous AI agents shift from novelty chatbots to active economic and operational actors, traditional Identity and Access Management (IAM)—built for humans clicking "Sign in with Google" or typing passwords—is breaking down . Startups and specialized platforms are rushing to build an Agentic Identity Access Platform (AIAP) layer.

The primary startups and infrastructure players defining identity, trust, and authentication for a web where agents are users span several key categories:

• Aembit provides Identity and Access Management tailored explicitly for workloads and agentic AI. Rather than treating an agent like a static service account, Aembit handles workload-to-workload authentication, enforcing dynamic, context-aware access policies during the actual transaction.
• Token Security focuses on the massive explosion of Non-Human Identities (NHIs) and autonomous agents. Their platform discovers shadow AI agents across SaaS and cloud footprints, binds them to verified human owners, and enforces least-privilege runtime access.
• Scalekit offers a developer-first, modular authentication layer built specifically for agentic workflows. It streamlines how developers handle agent-to-app token exchanges while gracefully scaling back to human-in-the-loop authentication when step-up approvals are required.
• 1Kosmos applies decentralized identifiers (DIDs) and verifiable cryptographic credentials to achieve zero-trust agent authentication. Their proxy architecture allows cross-boundary, multi-agent collaboration and validates delegation chains without requiring fragile pre-established corporate federations.
• Agentic Fabriq (backed by Y Combinator ) tackles the workspace layer, giving individual agent instances unique cryptographic identities, fine-grained scoped permissions, approval routing, and auditable action logs to replace overbroad shared API keys.
• Entro Security and Astrix Security (though positioned more broadly in non-human/secret management and posture management) are defining the structural hierarchy of how agents handle secrets, mapping out how short-lived JSON Web Tokens (JWTs) and mTLS should replace static credentials in autonomous runtimes.

How the Technical Paradigm is Changing

These startups operate on a consensus model distinct from traditional IAM:

1. Delegation over Isolation: Agents don't act as themselves in a vacuum; they inherit and scope down the authority of a human sponsor.
2. Intent & Context vs. Static Permissions: Because agents make non-deterministic runtime decisions (using tools via frameworks like Model Context Protocol - MCP), security requires evaluating intent at the gateway level rather than trusting the token blindly.
3. Ephemeral Lifecycles: Agent identities are short-lived (Time-To-Live scoped to a single task) and terminated immediately after execution.

Would you like to explore how these agent identity frameworks integrate with protocols like OAuth 2.1/OIDC or how they handle human-in-the-loop approval workflows for high-stakes agent actions?