Nobody Has a Good Answer for Agentic Identity Yet

4 pointsposted 12 hours ago
by mooreds

4 Comments

verdverm

12 hours ago

mooreds

11 hours ago

Anonymous credentials seem neat! I think there's also some interesting work going on with AAuth[0] and SPIFFE[1]

The issue is less in the identity of the agent and more in that:

1. We need to get users and companies used to issuing and using these credentials.

2. The systems agents are interacting with need to recognize these credentials.

3. Critically, the systems need to be able to limit the actions of the credential holders.

The last one, #3, is probably the doozie because it requires all kinds of rethinking of authorization models. Which tend to be baked into applications and tied to business logic.

0: https://www.aauth.dev/

1: https://spiffe.io/

verdverm

10 hours ago

ah yea, spiffe

ACs are useless unless we get the receiving end with sufficient RBAC like things, totally!