Agent Identity Stack: Three Vendors, Five Months, and a Missing Audit Trail

There is a checkbox inside Copilot Studio. An administrator names an agent, points it at a knowledge source, and presses create. Somewhere in the tenant a directory object materializes — a real identity, with a real object ID, a real lifecycle, and a real position in the access graph. No ticket. No approval queue. No human signature. The provisioning is automatic; the deprovisioning is a meeting someone will schedule later, in a quarter that keeps moving. I have seen this shape before. In 2017 I spent six months inside a Zurich security boutique auditing the contracts of a DAO successor project. I found a reentrancy path worth 500 ETH — roughly $2.1 million at the time — and wrote it up with stack traces and gas tables and a severity rating. The frontend team rejected the report for being "too academic." They shipped on schedule. The exploit landed eight weeks later and the postmortem blamed a sophisticated attacker. In the code, I found the ghost of the architect; nobody wanted to meet him. What I learned that winter was not a lesson about Solidity. It was a lesson about who is permitted to notice. Every identity cycle opens with the same promise: we have finally made trust programmable. In 2019 the promise wore the costume of self-sovereign identity — DIDs, verifiable credentials, a wallet as a soul. In 2021 it wore an ape. In 2025 the costume is an enterprise procurement category, and the promise has been quietly reversed: not that you can own your identity, but that your software can be issued one. The mechanics are not new. SPIFFE and SPIRE gave workloads cryptographic identity years ago. RFC 8693 defined token exchange so one principal could act on behalf of another. SCIM automated provisioning. SD-JWT and mTLS shrank the exposure window of a credential from hours to seconds. Non-human identity — service accounts, API keys, machine secrets — has been the least glamorous and most dangerous corner of enterprise security for a decade. Then, within five months, three platform companies arrived with the same answer at the same time. Microsoft shipped Entra Agent ID into preview at Build. Okta introduced agent identity governance and Cross App Access at Oktane. ServiceNow announced AI Passport. Three different doors, one room. A note on sourcing, because it matters more than usual here. The analysis I worked from dates these launches to 2026; the public record places all three in 2025. A full year of drift in a category this young is not a footnote — it is a discount rate applied to every competitive claim built on top of it. The same document leans on four quantitative data points, all originating in vendor-funded research: 96% of executives confident their agents are governed against 34% applying equivalent controls; 92% without complete visibility; 86% not enforcing access policies on agent traffic. These numbers are probably directionally true and are certainly not evidence. There is not a single incident report, lawsuit, or audit finding in the entire corpus. When a market is described exclusively by the companies selling into it, you are reading a pitch deck with footnotes. So let us read the architecture instead. Strip the branding and all three products are recombinations. Entra Agent ID is SCIM plus directory objectification — lifecycle provisioning with a graph attached. Okta's agent SSO is OAuth and OIDC with short-lived tokens and governance policy layered on top. ServiceNow's AI Passport is a signed credential with a policy engine behind it. Every component is a known primitive. There is no new identity paradigm in any of them, and the honest way to describe this moment is not "a new layer is forming" but "a mature layer is being repriced." What short-lived tokens actually buy you is a narrower leak window. They do not buy you least privilege, and they do not buy you behavioral conformance. Those are problems of attenuation — how authority narrows as it moves down a chain — and of runtime adjudication. Short-lived credentials make a stolen key less useful. They do nothing about a key used exactly as issued, by an agent that has been persuaded to want the wrong thing. And here is where the architecture genuinely fails. ServiceNow's model is described as the agent querying its own credential at runtime to verify the scope it has been granted. That is self-attestation. If the agent is prompt-injected, it will read its permissions correctly and then act outside them anyway, because the thing that was compromised was not its knowledge of the rules but its compliance with them. Authorization has to happen at the resource — at the policy enforcement point, on the far side of the request — not in the agent's own mouth. A passport that the traveler stamps himself is not a border. It is a souvenir. Then there is the asymmetry nobody has put in a press release. Provisioning has been automated; deprovisioning has not. Identity sprawl is now a solved problem in one direction only. Agents are created faster than employees are hired, and orphaned identities have always been the most reliable attack surface in any directory — the account nobody owns, the credential nobody rotates, the object that persists through three reorganizations because no one is measured on deleting it. Human offboarding has a checklist and a person accountable. Agent offboarding has a README. I want to be precise about the claim I am making, because it is the opposite of the one circulating. The measurement layer is not missing. It is crowded. Observability lives in LangSmith, Langfuse, Arize Phoenix, Weights & Biases Weave, Datadog's LLM observability, Dynatrace. Evaluation lives in Braintrust, Galileo, Patronus. Runtime guardrails have been consolidating hard — Prompt Security into SentinelOne, Protect AI into Palo Alto Networks, Robust Intelligence into Cisco — alongside Lakera, HiddenLayer, and Zenity. Cloud-native posture sits in Defender for AI, Wiz AI-SPM, Prisma AIRS. What does not exist is a single holder of all four pieces: the trace, the policy decision, the enforcement point, and the audit artifact. That is the gap. Not measurement — closure. And closure is not an engineering problem in the way the observability vendors think it is, because the fourth piece is not a dashboard. It is a document that an auditor will sign. There is a further omission worth naming, and it is structural rather than technical. Whoever owns the policy decision point owns the audit log, and whoever owns the audit log owns the system of record for what agents did. Microsoft wants the decision in the identity provider. The cloud platforms want it in the native policy engine. The observability vendors want it derived from trace. Three claims to the same throne, and the source material does not mention the contest at all — which is like writing about the Reformation without mentioning the papacy. Nor does it mention the standards. MCP's authorization model, the IETF WIMSE work on workload identity, SPIFFE, A2A, ID-JAG and Cross App Access — these are the actual battleground for cross-vendor agent federation over the next eighteen months. Their absence from a document that claims to analyze an identity stack is diagnostic. It tells you the author is reading announcements, not specifications. And there is an irony I cannot let pass. The report came out of a Web3 outlet and contains no blockchain content whatsoever — no DIDs, no verifiable credentials, no capability tokens. That is a shame, because the crypto world solved one of these problems a decade ago and solved it well. Delegation chains are the hard part of agent identity: Agent A calls Agent B, which calls tool C, and authority has to narrow at every hop, verifiably, without a round trip to a central authority. Macaroons and Biscuit do exactly this. Biscuit tokens are offline-attenuable, public-key verifiable, and carry their own authorization logic. Identity is a protocol; soul is the private key — and the attenuation problem was shipped, open source, in 2019. Enterprises will not adopt it. That is the part the maximalists miss. Biscuit has no governance wrapper, no SOC 2 mapping, no procurement story, no auditor who will accept it. The technology is solved; the accountability is not. Which is why the enterprise stack will rebuild the same capability, worse and more centrally, and pay for the privilege. Here is the contrarian read. The industry consensus — that measurement is immature and will mature — is the wrong frame, and it is the frame the vendors most want you to hold, because it implies the problem is time. The problem is translation. Detection precision is an engineering metric; audit admissibility is a legal one. The distance between "we observed the anomaly" and "here is evidence a regulator will accept" is not a feature gap, it is a different discipline. The company that builds the translator gets the budget, and it will not be the company that built the detector. More uncomfortable: for a non-deterministic system, monitoring cannot provide guarantees. It can only shift probabilities. Agent governance is therefore not access control wearing a new badge — it is risk tolerance management, and it should be budgeted and staffed like risk, not like IAM. Once you accept that, the buyer changes. Not the CISO. The CIO and internal audit, and eventually the underwriter. Insurance is the hard payer here: a carrier writing AI agent liability will demand verifiable behavioral records as a condition of cover, and that is a budget line no one can defer. And the regulation is being misread in public. The EU AI Act's high-risk obligations demand record-keeping, human oversight, and traceability — evidence, not detection. NIST's AI Risk Management Framework is voluntary and issues no gap ratings; a claim to the contrary in my source material could not be traced to the framework itself, and I am treating it as commentary rather than standard. ISO/IEC 42001, the one certifiable AI management system standard, is the actual procurement lever and appears nowhere in the discussion. That is the difference between selling a camera and selling a compliance certificate. Watch three signals, not the product launches. The first public agent-overreach incident with a name attached — a breach, a lawsuit, a regulatory inquiry — inside the next twelve months; if it does not arrive, the risk was oversold. The first generally available price list with a per-evaluation unit rather than a per-seat one, which will tell you whether the identity layer is genuinely commoditized. And the first insurance product that makes behavioral evidence a condition of cover, which will convert a discretionary security purchase into a mandatory one and reprice the category overnight. When the pool empties, only the intent remains. The audit is not a check; it is a confession — and nobody has yet built the room where the confession can be heard.