Most people read Okta's agent identity launch as a security product. It isn't. It's a billing-unit migration wearing OAuth clothing.
The detail that gives it away sits in the deployment status. Okta's cross-app access flow โ marketed as the Identity Assertion Authorization Grant, or XAA โ depends entirely on the Runtime Agent Gateway to execute. That gateway entered beta on September 16, 2026. It has not reached general availability. The token semantics underneath it rest on ID-JAG, which is an IETF Internet-Draft, not an RFC.
So the headline claim โ that the market is building around pre-GA standards โ reads more precisely as: the market is building around pre-standard standards. Two layers of unfinished work, stacked, announced as infrastructure.
I have spent enough of my career on execution paths to know what an inline component costs. I'll get to the latency math. First the mechanics, because the mechanics here are real, and mostly correct.
Context
OAuth 2.0 Token Exchange, RFC 8693, has existed since 2019. A caller presents one token and requests another: scoped down, audience-restricted, short-lived. The act claim โ actor โ lets you nest delegation, so a token can be issued to agent B on behalf of human A, with the chain legible to any resource server that cares to read it. Audience binding stops replay against a different endpoint. A revocation list plus a 60-second TTL kills a compromised credential before the next block confirms.
None of that is new. Okta's contribution is composition and packaging: wire RFC 8693 into an agent-specific consent flow, downscope to a single task, carry the human sub claim alongside the nested agent act claim, and place a gateway on the execution path to perform the exchange inline. That is an engineering contribution, not a protocol invention. The genuinely interesting modeling choice โ treating an agent as a first-class identity rather than a generic machine principal โ is conceptual, not architectural. It matters anyway, because it changes what you can audit and what you can invoice.
Why should anyone in this market care? Because the same problem is already live on-chain, and nobody has solved it cleanly. Every DeFi agent, every automated vault rebalancer, every market-making bot I have run since the 2020 yield-farming cycle holds a credential with too much scope and too long a life. My 2026 market-making system executed roughly 10,000 trades a day against a 0.5% per-transaction edge, with a 2% maximum drawdown. If that key had leaked, the edge would have been irrelevant. The drawdown would have gone to 100%, not 2%. That is the exact failure mode static API keys manufacture, and it is why I read this launch as infrastructure rather than marketing.
The Core
Strip the naming and four moving parts remain. A gateway intercepts the agent's tool call. It presents the inbound token plus the requested scope to Okta's token endpoint. A security token service completes consent and returns a short-lived, single-use ID-JAG token. That token is downscoped to the specific task and carries both the human subject claim and the nested actor claim.
The risk reduction is genuine within its boundary. No long-lived secret sits in a config file. Blast radius is capped by scope. A runaway agent can be revoked in seconds rather than rotated over a weekend. Audit trails reconstruct who authorized what, on whose behalf, for which task.
Now the cost, which the launch material does not price.
The gateway is inline โ it sits between the agent and its tool call. Every call pays a token-exchange round trip. My own deployments taught me what that means: at 4,000 tool calls per agent per day across a 500-agent fleet, you generate 2 million exchanges daily. That averages to roughly 23 queries per second against the token endpoint, and averages lie. Agent workloads are bursty. A morning batch sweep or a liquidation cascade spikes 10x for minutes at a time, and the token endpoint becomes a hot path with a queue in front of it. Nobody has published the P99. Nobody has published the fail-open versus fail-closed policy either, and that single decision determines whether the security value is real or theatrical. Fail-open, and the gateway is decoration. Fail-closed, and Okta's availability becomes your trading availability.
The real story is the billing unit. Okta has historically priced per monthly active user. Defining an agent as a first-class identity is, commercially, defining it as a billable seat. A firm running 500 agents against 5,000 employees does not merely buy governance โ it buys a new revenue line for its identity vendor, plausibly 10% to 50% on top of the human seat base. That is the entire growth narrative in one architectural decision, and it is absent from every write-up I have read.
Which makes the missing pricing data the largest hole in the story. Is agent identity inside the existing SKU? Is the gateway metered per exchange? Is there a free tier or a developer sandbox? Without unit economics, no revenue model can be evaluated โ only a narrative.
Audit volume deserves the same skepticism. A human authenticates a handful of times a day. An agent generates thousands of events, each with a delegation chain attached. That is two orders of magnitude more log volume flowing into SIEM and observability tiers priced per gigabyte. The governance product is, functionally, a data-volume product sold to the security budget. Fine for Splunk and Datadog. A new line item for the customer.
Ecosystem evidence is thin. Two named adapters โ Aembit as a third-party enforcement point, TrueFoundry integrated as of October 1, 2026 โ both small vendors, both in pre-GA. Two data points do not constitute a market building around anything. Small vendors adopt early standards because co-marketing with a listed identity vendor is cheap. That is a rational decision and it is not demand.
The customer proof is weaker still. The one named reference is the IT director of a mid-size packaging manufacturer. Low regulatory intensity, modest agent footprint, no evidence of the multi-cloud heterogeneity where Okta's neutrality actually pays. The absence of financial services, healthcare, or public sector references is itself a signal. Those are the buyers for whom an auditable delegation chain is worth a gateway round trip. They have not spoken.
And the standards risk is unpriced. Internet-Drafts drift. Field names change, semantics get redefined, drafts get abandoned โ the IETF is littered with OAuth extensions that never became RFCs. Early implementers are not capturing standard-setting upside. They are holding standard-drift risk.
The question the article never asks is the one that decides the outcome: how does ID-JAG interoperate with MCP? Agent tool invocation is converging on MCP, and MCP already carries an authorization model built on OAuth 2.1 with Resource Indicators. Whether ID-JAG complements, competes with, or conflicts with that model is the technical question on which this entire architecture lives or dies. It goes unmentioned. So does federation โ what happens when the customer's primary identity provider is Entra and Okta's gateway is an overlay.
The Contrarian Read
Here is where the framing breaks. Identity governance is not agent safety, and conflating them is a category error.
A perfectly scoped, correctly downscoped, short-lived token does nothing against a confused deputy. Inject a prompt into an agent's context and it will use its legitimate credential to take a legitimate action with a malicious intent. The authorization was flawless. The outcome was theft. On-chain this is not hypothetical โ a session key capped at $10,000 still drains $10,000 in a single block if the agent holding it gets hijacked. Downscoping limits the size of the loss. It does not prevent it. Nothing in this stack addresses agent supply chain, model poisoning, or legitimate-scope data exfiltration.
Then there is the gatekeeper paradox, which the source material omits entirely. In October 2023, Okta's support system was compromised; attackers obtained support credentials and reached sensitive customer-uploaded files. The company now asking enterprises to route every agent authorization decision through its own gateway is the company whose trust chain was breached three years ago. For a security buyer, that is the first question in the room. For Microsoft, it is free ammunition.
And concentrating scattered key risk into a single inline็ญพๅ point is a trade, not a win. A gateway that can mint a token for any agent is the highest-value target in the architecture. Whether consolidation is net positive depends entirely on that gateway's own threat model โ sharding, least privilege, blast radius control โ about which nothing has been published.
Watch the framing on Microsoft too. Project Perception gets described as trend validation rather than competitive threat, which is the standard move: demote your strongest rival to weather. Entra Agent ID can be bundled into Microsoft 365, Azure, and Copilot at zero marginal cost. Okta's only durable differentiation is neutrality across clouds, models, and agent frameworks โ genuinely valuable in heterogeneous estates, and precisely the ground Microsoft can concede as good enough.
And note Aembit's dual identity. Partner in the press release. Lighter-weight substitute in the procurement meeting, one that can run the exchange without Okta's gateway at all.
Every layer of this adds a tax: a round trip, a token issuance, an audit record. Solve a bottleneck, inherit a new one. The floor didn't hold last time someone assumed governance infrastructure scales free.
Takeaway
Four numbers to watch, and none of them are in the announcement. The gateway's GA date and its published P99. ID-JAG's movement from draft to RFC, plus the implementer count behind it. Whether MCP absorbs this model or routes around it. And the price of an agent seat โ that is the tell on whether this is a product or a narrative.
My read: the alpha in agent infrastructure is not in the identity layer. Identity is commoditizing into protocol. The value accrues to the enforcement layer โ the policy engine that decides, inline and in milliseconds, what an agent may do with a credential it legitimately holds. Crypto reached that conclusion years ago with session keys and account abstraction, at a fraction of the cost and with far worse UX. The enterprise stack is arriving at the same answer, four years late, and paying a gateway round trip for the privilege.
So the question is not whether Okta can define the standard. It is whether anyone will still be paying per seat when the standard stops being theirs.