The number that matters in the agent identity market is not six. It is 154 to 38.
That is the vote split inside the IETF over whether to charter a working group: 154 people in favor of doing something, 38 willing to endorse the actual proposed charter text. Anyone who has watched a standard die recognizes the shape. Consensus on the verb. Deadlock on the noun.
Meanwhile five of the six vendor launches landed inside seven weeks โ August 24 through October 15, 2026. Two of them on the same day. Not one published a price. Not one published a deployment count, a renewal rate, or a named paying customer. In a bear market where every infrastructure line item is being renegotiated, six vendors shipped agent identity and zero vendors shipped evidence that anyone bought it.
Let us be precise about "shipped." It means a press release with a diagram.
The technical artifact underneath the noise is ID-JAG โ Identity Assertion JWT Authorization Grant โ currently at an -04 revision with a stated validity through November 22, 2026. Strip the acronym and it is three known mechanisms wired in series: JWT bearer assertion issuance under RFC 7523 (2015), cross-authorization-server token exchange under RFC 8693 (2020), and scoped tokens under OAuth 2.1 scope semantics. That is the entire construction. The increment is architectural placement, not cryptography โ the identity provider, rather than each individual resource server, becomes the root of a chain running user โ application โ agent โ target resource. Valuable convergence. Zero new primitives. Composite engineering, not invention.
The market narrative frames this as two camps: ID-JAG anchored versus protocol-agnostic. That framing is a decoy. The real dividing lines sit one layer down, in places the launch material never names.
Delegation semantics. How does a system express, end-to-end and tamper-evidently, that Agent B acts for Agent A, which acts for user U, scoped to permission S? ID-JAG answers the token-fetching half of this and nothing about the semantic compression of a multi-hop chain. No vendor in the set solves it. An audit log that cannot reconstruct the chain in one verifiable credential is not an audit log; it is a diary.
Proof of possession. If the credential is stolen, does it stop working? This is where the field is nearly empty. Descope supports SPIFFE workload identity with mTLS binding โ the only one of the six touching this layer at all. Everyone else defaults to bearer tokens. A bearer token is a password with better formatting. Code does not lie, but it often forgets to breathe: a credential that carries no proof of the holder's private key is a credential that works equally well for whoever has it.
Revocation granularity. Can you kill one hop in a delegation chain without collapsing the whole chain? ServiceNow's tiered execution plus kill switch is coarse, but it is the only explicit answer in the set.
These three layers are the actual competitive terrain for the next eighteen months. Token format is not.
The proof-of-possession gap is the one I would flag to any treasury or protocol team currently wiring agents into signing infrastructure. I spent 2020 auditing the liquidity mining contracts of a small DEX and found reentrancy in the reward distributor โ the flaw lived in a state-changing function, not in the trust model on the whitepaper's second page. The same structural failure is repeating here. Agent identity products are being marketed on the trust model. The exploit surface is the state change: an agent whose token is exfiltrated via a prompt injection or a leaked environment variable remains, from the identity provider's perspective, perfectly legitimate. The system cannot distinguish a hijacked subject from the real one, because it never asked the subject to prove anything.
This is the same failure class as oracle feed latency in DeFi. The system trusts an assertion past the moment the assertion stops being true, and the gap between those two moments is where the money leaves. Agent credentials with multi-hour TTLs and no holder binding are a stale price feed wearing a suit.
The protocol-agnostic pitch deserves equal skepticism. Postman and Cequence are positioned as neutral governance layers that accept any token format. Accepting arbitrary formats is trivial. What they must actually do is normalize MCP's authorization model โ OAuth 2.1 with Resource Indicators and an enterprise-managed authorization extension โ against A2A's Agent Card security schemes, which are predominantly OIDC and OAuth2. Those two models are not isomorphic on subject identification, capability declaration, or delegation chain expression. "Protocol-agnostic" is not a feature you ship; it is a cross-protocol semantic translation layer you write, and nobody has published the mapping table.
The most consequential technical fact in the whole release cycle got buried in a subordinate clause: Microsoft did not implement ID-JAG. Entra ID holds the largest installed base of enterprise identities on earth. Its absence means ID-JAG cannot become a default, no matter how many partners Okta recruits into a 25-member alliance. The real structure is three-way, not two-way: standards anchors (Okta, Descope), protocol-agnostic brokers (Postman, ServiceNow, Cequence), and platform natives (Microsoft), whose entire strategy is that a standard is unnecessary when you own both ends of the connection. Identity, like hash power, concentrates into a small number of pools and then calls the result decentralization.
ServiceNow is the vendor most misread by the coverage. Its differentiation is not "AIMS and WIMSE instead of ID-JAG." It is that policy decisions draw on CMDB and GRC data. The hard problem in agent identity is not issuance. It is determining what a given agent should be permitted to reach โ and that determination requires an authoritative inventory of assets and dependencies. ServiceNow owns the most complete enterprise CMDB in existence. It does not need to win the standards fight because it occupies the input side of the policy engine.
On-chain, the same three-layer problem is already load-bearing. ERC-8004 agent registries, EIP-7702 delegation, and session-key schemes all assume a scoped credential grants authority to a delegate. Most implementations inherit bearer semantics by default: the session key is the identity. A prompt-injected agent holding a valid session key is indistinguishable from its owner, and the revocation path is usually "revoke everything." When I restructured SNARK constraints in 2024 to cut proving time 30%, the lesson generalized โ the constraint system defines what can be proven, and if the circuit does not constrain holder binding, no amount of prover optimization makes the proof mean anything. Agent identity is a circuit design problem disguised as a product category.
Gas wars are just ego masquerading as utility, and a large share of the coming agent-driven on-chain volume will be the same: transactions that exist to demonstrate throughput rather than to settle anything anyone needed.
The deepest omission in the coverage is not a vendor. It is certification. Enterprise procurement does not cite RFC numbers in a tender; it cites Kantara certification and FIDO Certified marks. Historically, enterprise identity profiles โ the entire FAPI family โ converged inside the OpenID Foundation, not the IETF. An RFC without an assurance program is unprocurable. There is no RetroPGF for standards work, so the only drafts that get finished are the ones with a vendor paying someone's salary to finish them.
And there is the unresolved problem nobody in the six is touching: the legitimate subject performing an illegitimate action. An agent with valid credentials, hijacked mid-session by injected instructions, passes every check the identity layer knows how to run. Until capability declarations bind to code and model integrity โ not just to a scope string โ agent identity authenticates the envelope and ignores the letter.
What to watch, concretely: whether -05 clears Working Group Last Call before the November 2026 expiry, which would signal a narrow profile rather than a general standard; whether Entra bundles agent identity into existing E5/E7 entitlements at zero marginal cost, which would collapse per-identity pricing across the category; and whether CyberArk, HashiCorp Vault, or the NHI security startups โ Astrix, Oasis, Entro โ acquire Descope or Cequence outright, since they are the only buyers with both motive and balance sheet.
Per-agent pricing breaks the moment agents outnumber employees by a hundred to one. The anchor becomes per-policy-evaluation. The question for the next twelve months is not which vendor wins the format war. It is which of the six has enough runway to survive a standards cycle that has already failed once at the charter stage.