AINEWS
Forrester reads Okta's Oktane 2026 user conference announcements as a real bid for the agent authorization layer: a unified identity control plane, an Okta recruited "Blueprint Alliance" of identity and AI vendors, and an extension to Anthropic's
Before an AI agent is allowed to touch a real system, someone has to decide it is allowed to, on whose authority, and for how long. That is the question Okta put at the center of its Oktane 2026 announcements this week, and the one Forrester's same-week recap reads as still half-answered.
Okta is the identity-and-access-management company behind enterprise login and single sign-on. Its pitch at Oktane was that the same plumbing that signs human users into SaaS apps can now sign in non-human identities (NHIs): the API keys, service accounts, and AI agents that act inside a business. According to Okta's Oktane 2026 press release, Agent SSO, agent-to-agent connections, and resource access certifications are already generally available. The Agent Gateway that brokers which agents can reach which resources, plus endpoint discovery, lands in Q3. A configuration designer and an expanded runtime kill switch for revoking active tokens and shutting down sessions in flight are planned for Q4.
The product rollout is one half of the announcement. The other is the policy architecture Okta wants the rest of the industry to adopt around it.
Okta used the keynote to recruit a "Blueprint Alliance" of identity, infrastructure, and AI vendors behind a shared agent-identity model. The "unified control plane" pitch is meant to cover three populations under one policy surface: human employees, NHIs, and the agentic systems built on top of them. Okta also announced it is contributing to an extension of Anthropic's Model Context Protocol, the open specification that lets AI agents carry user permissions across applications, adding cross-app agent authorization through what the protocol calls MCP Authorization Extensions. Forrester's recap of the keynote identifies what the extensions cover — cross-app access (XAA) and Enterprise Managed Access — and flags open questions about the specification's formal status.
The open-standards story runs into its limits there. Forrester's recap of the keynote identifies four pieces of the unified-control-plane pitch that the vendor has not yet closed: SPIFFE, the open standard for workload identity, is partially implemented; Fine Grained Authorization, which decides what an authenticated agent is actually permitted to do at the field or action level, is not yet specified; agent-IAM pricing is undisclosed, with Forrester expecting transaction-based billing once it lands; and the multi-vendor open-standards story only works if Okta's competitors and the formal standards bodies show up. Forrester's view: the pieces are real, but they are landing on different timelines.
The mechanism under negotiation is who delegated the authority, what scope that delegation carries, and how it gets revoked when something goes wrong. Once an agent can pull a record, move money, or modify a customer's account, the security question is no longer whether the model can do the task. It is whether the system can stop it.
The buyer-side calculation is the one most enterprise security teams will actually run. The control plane pitch is appealing precisely because agents, unlike human employees, can be created and torn down in minutes, and because audit trails on who delegated what authority to which agent, and when, are not yet a solved problem across the industry. Adopting Okta's control plane means trusting one vendor to sit on the policy surface that decides what every AI agent in the business is allowed to do. Holding out for a formal standards-body ratification means tolerating, for now, the slower and more piecemeal path of bolting controls onto each agent framework separately. Okta's bet is that the control plane wins the first round because the agent rollouts cannot wait.
The next concrete checkpoint is Q3, when the Agent Gateway and endpoint discovery are slated to arrive. If the gateway ships on the public roadmap and the Blueprint Alliance list grows without a competing identity vendor publishing a parallel spec, Okta's control plane pitch gets a year of gravity behind it. If SPIFFE, Fine Grained Authorization, and pricing still have not converged by the time the kill switch lands in Q4, the analyst assessment will harden from "details remain unclear" to "details did not land."