Okta's Blueprint Alliance gives buyers a six-point checklist for AI agent identity

Okta frames the problem as an identity gap in which shadow agents multiply, credentials cross trust boundaries and agents execute beyond their intended scope ^[10]. For an attacker, all three come down to one asset: a working credential held by software that nobody is watching. The architecture's discovery layer is meant to catalog every agent, whether internally built, imported from SaaS and third parties, or unmanaged shadow AI ^[9]. Each is then registered as a distinct identity with an accountable human owner or team ^[9]. I'd expect the third-party agents to be the hardest to inventory, since their credentials are used from infrastructure the buyer does not run.

The coverage is narrow by design. According to Okta's release, the architecture addresses governance once agents are deployed and complements separate work on model security and supply chain integrity ^[17]. A poisoned model or a tampered agent package sits outside it.

Five of the six principles describe something a vendor can demonstrate in a pilot ^[3]. A buyer can ask to see every agent listed with its owner, the task an access grant is scoped to, the delegation chain from human to agent to tool, the runtime log, and an agent revoked and then restored. The sixth, that governance "adapts at the speed AI moves," has no test a buyer can run ^[3].

Of Okta's own Oktane releases, Agent Gateway maps to the scoping and runtime-monitoring principles ^[11]. Endpoint discovery answers the first of the architecture's four questions, "Where are my agents?" ^[8][11]. The kill switch that would revoke active tokens and terminate sessions when an agent is deactivated is still described as planned ^[12].

The status of the work depends on who describes it. SC World, summarizing Silicon Angle, wrote that the alliance is working to evolve Okta's initial framework into an open standard ^[6]. Okta's release calls the result an open, multi-vendor reference architecture, grown from a blueprint Okta first introduced in March 2026 ^[4]. The release does not describe a specification or a compliance test. Okta plus the 11 companies it named makes 12 vendors, the count SC World also gave ^[7]. Two outside organizations, GE Appliances and World Central Kitchen, signed on as strategic advisors to help refine and validate the approach ^[14].

The case for urgency rests on a Gartner forecast cited in Okta's release: more than 150,000 agents in use at an average global Fortune 500 enterprise by 2028, against 13% of organizations that think they have the right agent governance in place ^[5].

"To do so responsibly requires establishing governance that is as dynamic as the agents themselves," said Brian Stoll, chief technology officer of World Central Kitchen ^[15].

"Unlocking that value at scale requires strong governance, clear visibility into where agents operate, what they can access and how they make decisions," said Mandar Deo, chief digital technology officer at GE Appliances ^[16].