Identity Startups funded by Y Combinator (YC) 2026https://www.ycombinator.com/companies/industry/identity
1%
Agentic AI Identity Management Approach | CSAhttps://cloudsecurityalliance.org/blog/2025/03/11/agentic-ai-identity-management-approach
1%
Meet The Start-Ups Promising To Hold AI Agents To Accounthttps://www.forbes.com/sites/davidprosser/2025/09/16/meet-the-start-ups-promising-to-hold-ai-agents-to-account/
1%
Proof business platformhttps://www.proof.com/
1%
A New Identity Playbook for AI Agents in 2026https://www.strata.io/blog/agentic-identity/new-identity-playbook-ai-agents-not-nhi-8b/
If by “the web where agents are users” you mean a web where software agents can independently browse, authenticate, transact, call APIs, and delegate work—while still being accountable to a human or organization—the emerging stack is starting to separate into a few layers.
The startups / companies I’d watch
Company
What it is becoming in the agentic web
Core question it answers
Proof
Agent authorization + verifiable claims
Who authorized this agent, and what can it prove about itself?
How does an agent get its own scoped identity rather than impersonating a user?
Stytch
Developer identity/auth infrastructure extended to agents
How do I authenticate and authorize agents inside an application?
Auth0 / Okta
Enterprise identity control plane for agents
Which human, agent, or organization is responsible for this action?
Cloudflare
Agent identity + wallet + edge enforcement
Can I identify an agent and safely let it transact?
Stripe
Agentic payments + buyer/business identity
Can an agent make a purchase while preserving authorization and payment controls?
Persona
KYC/KYB and verification for agent principals
Is the person/company behind this agent actually verified?
Descope
Identity workflows for agentic applications
How do I put authentication, authorization and policy around agents?
Curity
OAuth/OIDC infrastructure for agent authorization
How should delegated authorization work when the actor is an agent?
Stainless
Agent-friendly API/SDK infrastructure
Can agents reliably discover and use APIs?
The interesting thing is that no single company owns the whole problem yet.
1. Proof — probably the most directly “agent-native” identity bet
Proof is attacking a particularly important primitive: proof of authority.
Its x401 protocol lets a website/API request verifiable information about the entity behind an agent—such as verified identity, organizational affiliation, membership, signing authority or other claims.
That is a subtly different problem from authentication:
“I know this credential is valid”
versus
“I know who authorized this agent to do this.”
That second problem becomes fundamental once agents can act autonomously.
2. WorkOS — agent credentials as first-class identities
WorkOS is approaching this from enterprise identity.
Its proposed model explicitly gives the agent a separate, scoped credential rather than handing an agent the user's entire session. The resulting token represents what the user authorized the agent to do, not everything the user can do.
WorkOS is also exploring an AUTH.md mechanism for agentic registration and an ID-JAG-style identity assertion between agent providers and services.
This is important because the agent shouldn't simply be:
Alice's browser session
It needs to be:
Agent A → authorized by Alice → allowed to perform X → expires/revokes independently
3. Auth0 — turning IAM into “agent IAM”
Auth0 is arguably the clearest incumbent trying to turn conventional IAM into agent identity infrastructure.
Auth0's current agent offering explicitly covers unique agent identities, delegation, scoped permissions, short-lived tokens and auditability.
And its September 2026 Agent Gateway is positioned as a control plane for customer-facing agents, including identity-bound execution and credential delegation.
The architectural shift is:
old web
Human → Browser → Website
agent web
Human → Agent → Agent → API
Identity has to survive that entire chain.
4. Cloudflare — identity meets the actual Internet
Cloudflare is attacking this from the network/edge side.
In August 2026 it announced Cloudflare IDs and Wallets specifically for agents. An agent can have a stable identity connected to its owner, while individual agents can receive constrained wallets with spending caps, merchant restrictions and transaction limits.
That's a particularly interesting direction because it combines:
identity → authorization → transaction → payment
rather than treating them as separate systems.
And it addresses the question websites increasingly face:
“This request came from an AI. Is it acting for a real customer, and who?”
That's becoming an immediate practical problem: Amazon recently blocked Meta's Muse agent, citing concerns including its failure to identify itself appropriately while browsing.
5. Stripe — identity becomes inseparable from money
Stripe is building the payments side of the same architecture.
Its agentic-commerce work uses secure payment tokens and its Link wallet to preserve customer identity and purchase history across AI surfaces, while providing spending limits and explicit permissions for agents. Stripe also describes validating both business identity and buyer identity/authorization.
This is potentially a very important primitive:
Agent identity without financial authorization isn't enough.
An agent that can buy something needs a capability such as:
Alice authorizes Agent X to spend up to $500 at approved merchants for this task.
That's closer to capability-based security than traditional login.
6. Persona — proving the human/company behind the agent
Persona sits one layer underneath.
The interesting problem isn't necessarily verifying the AI itself. It's verifying the principal behind the AI:
Who is this person?
Is this company real?
Is the organization authorized to perform this action?
Is this agent representing that organization?
Does the agent's authorization remain valid?
That becomes particularly relevant for financial services, marketplaces, procurement and high-value transactions.
The bigger architecture
I think the emerging stack looks something like this:
The key primitive isn't really authentication anymore.
It's delegated authority.
The web's existing model assumes:
“A human authenticated, therefore this session represents that human.”
The agentic model needs:
“This agent is cryptographically/cryptographically-verifiably associated with this principal, this principal delegated these capabilities, and this particular action falls within that delegation.”
That's a much richer identity graph.
companies building agent wallets and payment authorization
And then there's a fourth category that I think is underappreciated:
Agent discovery + API identity
Stainless and similar infrastructure companies are making APIs more legible to agents. That's not authentication by itself, but it becomes part of the agent-to-service protocol stack. WorkOS's AUTH.md work is a good example of the ecosystem beginning to define how agents discover how to authenticate, not merely how humans do so.
What I think is still missing
The really interesting startup opportunity may be above all of these individual products.
A mature agentic web needs something like a “passport + power of attorney + credit card” for agents:
Identity — this is Agent X.
Principal — Agent X represents Alice/Acme.
Authority — Alice authorized X to perform Y.
Constraints — only these APIs, merchants, data and dollar limits.
Delegation chain — X delegated part of the job to Y.
Proof — the recipient can verify the whole chain.
Revocation — Alice can kill X's authority without changing her own identity.
Reputation — services can establish whether X has behaved reliably.
Settlement — X can actually pay/receive money.
Auditability — after something goes wrong, humans can reconstruct who authorized what.
We're already seeing evidence that this isn't theoretical: banks are raising concerns about AI shopping agents precisely around identity, fraud, authorization, data protection and accountability.
If I were mapping the competitive landscape, I'd therefore watch Proof and WorkOS particularly closely for the “identity + delegation” layer, Auth0 for the incumbent enterprise control plane, and Cloudflare/Stripe for the “identity becomes transaction infrastructure” layer. That's a description of where each is positioning itself, rather than a ranking of which is superior.
companies building agent wallets and payment authorization
And then there's a fourth category that I think is underappreciated:
Agent discovery + API identity
Stainless and similar infrastructure companies are making APIs more legible to agents. That's not authentication by itself, but it becomes part of the agent-to-service protocol stack. WorkOS's AUTH.md work is a good example of the ecosystem beginning to define how agents discover how to authenticate, not merely how humans do so.
What I think is still missing
And its September 2026 Agent Gateway is positioned as a control plane for customer-facing agents, including identity-bound execution and credential delegation.
The architectural shift is:
old web
Human → Browser → Website
agent web
Human → Agent → Agent → API
Identity has to survive that entire chain.
4. Cloudflare — identity meets the actual Internet
Cloudflare is attacking this from the network/edge side.
In August 2026 it announced Cloudflare IDs and Wallets specifically for agents. An agent can have a stable identity connected to its owner, while individual agents can receive constrained wallets with spending caps, merchant restrictions and transaction limits.
That's a particularly interesting direction because it combines:
identity → authorization → transaction → payment
rather than treating them as separate systems.
And it addresses the question websites increasingly face:
“This request came from an AI. Is it acting for a real customer, and who?”
That's becoming an immediate practical problem: Amazon recently blocked Meta's Muse agent, citing concerns including its failure to identify itself appropriately while browsing.
5. Stripe — identity becomes inseparable from money
Stripe is building the payments side of the same architecture.
Its agentic-commerce work uses secure payment tokens and its Link wallet to preserve customer identity and purchase history across AI surfaces, while providing spending limits and explicit permissions for agents. Stripe also describes validating both business identity and buyer identity/authorization.
This is potentially a very important primitive:
Agent identity without financial authorization isn't enough.
An agent that can buy something needs a capability such as:
Alice authorizes Agent X to spend up to $500 at approved merchants for this task.
That's closer to capability-based security than traditional login.
6. Persona — proving the human/company behind the agent
Persona sits one layer underneath.
The interesting problem isn't necessarily verifying the AI itself. It's verifying the principal behind the AI:
As AI agents transition from novelty chat interfaces to autonomous actors that write code, call APIs , execute financial transactions, and manage enterprise data, traditional Identity and Access Management (IAM) is breaking down. Conventional IAM relies on static human logins or long-lived API keys/service accounts. For an agentic web, security requires managing a blended identity —knowing which agent is acting, whose human authority or user context it carries, and which tools (like Model Context Protocol servers) it is allowed to touch.
A new wave of specialized startups and infrastructure plays are defining this space:
Aembit operates as an independent identity broker built specifically for agentic AI and non-human workloads. It solves the problem of "standing privileges" by combining an agent's workload identity with the associated human user into a blended identity. Rather than storing long-lived secrets, Aembit evaluates context in real time and issues short-lived, cryptographically verified credentials for agent-to-API and agent-to-MCP (Model Context Protocol) server communications.
Scalekit focuses heavily on outbound authentication and tool-calling security for B2B AI builders. Instead of hardcoding master API keys or messy shared service accounts, Scalekit orchestrates delegated OAuth flows (for tools like GitHub, Slack, Salesforce, and Gmail), manages encrypted token vaults, and issues short-lived, scoped agent tokens bound to a single user consent action.
SecureAuth moved into the operational control layer with its Agent Authority Platform , designed to govern AI agent identities in real time. It acts as a zero-trust authorization check on every autonomous API call or data manipulation an agent attempts mid-workflow.
Agentic Fabriq (backed by Y Combinator) tackles agent permissioning and governance at the team/enterprise layer. It assigns unique identities to individual agents, manages scoped cross-app permissions, and builds human-in-the-loop approval workflows so organizations don’t have to rely on overbroad API keys.
CrowdStrike (moving aggressively via its Falcon platform) introduced an Agentic Identity Provider (Agentic IdP) to serve as an enterprise control plane. It ties non-human agent identities directly to the human and infrastructure context behind them, adapting access permissions dynamically based on real-time security signals.
Auth0 (by Okta) —while an established giant rather than an early-stage startup—is aggressively productizing an "Auth for AI Agents" stack (featuring Token Vaults and MCP tool delegation mechanics) to prevent developers from exposing raw user credentials to autonomous loops.
Would you like to explore how these startups handle the Model Context Protocol (MCP) or dive deeper into the architectural difference between workload identity vs. blended agent-user identity?
The “agentic web” is creating a new identity stack because the old web assumption — a human with a browser session, password, and account — breaks when the actor is a software agent that can negotiate, buy, call APIs, delegate work, and operate continuously. The emerging stack has several layers:
Who is the agent? (cryptographic identity, certificates, passports)
Who authorized it? (delegation from a human or organization)
What can it do? (scoped permissions and policy)
Can others trust its claims? (attestation, reputation, provenance)
Can actions be audited and revoked? (accountability)
Several startups are positioning themselves around these layers:
Agent-native identity and trust infrastructure
Skyfire — agent identity + payments
Skyfire is building what it calls an “Agent Trust Stack”: identity, access, and payment infrastructure for AI agents. Its focus is enabling businesses to distinguish legitimate agents acting for real users from anonymous automation, including “Know Your Agent” style verification.
Core bet: the next web needs a “merchant trust layer” for agents, similar to how TLS enabled trust between websites.
Proof — authorization proof for agents
Proof is focused on proving the relationship between an agent and the person or organization behind it. Its x401 protocol is designed so websites and APIs can ask: “Who authorized this agent’s action?” rather than simply accepting an API token.
Core bet: agent identity alone is insufficient; services need proof of authority.
Affinidi — decentralized identity for humans and agents
Affinidi applies self-sovereign identity concepts (DIDs, verifiable credentials) to AI agents, arguing that agents need portable identities that can move across systems rather than being tied to one platform.
Core bet: the agent should carry verifiable credentials, not borrow a human’s identity.
Dentity — reusable identity credentials
Dentity provides identity infrastructure built around reusable credentials and wallets, extending its model to AI agents and enterprise verification flows.
Core bet: identity should become a reusable asset rather than repeated database checks.
Agent authentication and access control
Stytch — developer authentication primitives
Stytch has been extending modern authentication infrastructure toward agent-related workflows, including delegated authorization patterns.
Core bet: developers will need agent-aware authentication APIs, not just human login flows.
WorkOS — enterprise identity plumbing
WorkOS focuses on enterprise authentication infrastructure (SSO, directory sync, access controls) and is among the companies adapting identity infrastructure for agent-era enterprise environments.
Core bet: companies will need to manage agents like employees and service accounts.
Fidea — agent identity and policy enforcement
Fidea positions itself as an identity and access layer for AI agents, emphasizing credential isolation, observing agent calls, and enforcing policies.
Core bet: agents need their own credentials rather than borrowing user tokens.
Agent certificates, attestation, and “Know Your Agent”
AgentPass — cryptographic passports for agents
AgentPass is building certificate-style identity for AI agents, including signed identities and trust levels.
Core bet: agents will need something analogous to website certificates or employee badges.
IDevSec — open trust protocols
IDevSec is developing cryptographic identity and attestation infrastructure for agents, including the Creduent Protocol.
Core bet: open protocols may win over proprietary agent registries.
WIDTH — KYA (Know Your Agent)
WIDTH is focused on agent identity, capability attestation, and accountability — essentially extending KYC/KYB concepts to autonomous software.
Core bet: enterprises will need to know not just “who is the customer?” but “which agent is acting, under whose authority, with what permissions?”
Incumbents likely to shape the market
Startups are not alone. Major identity vendors are adapting:
okta.com — through its identity platform and investments, including interest in agent trust infrastructure.
microsoft.com — developing agent identity and lifecycle management capabilities for enterprise environments.
A mature agent identity system probably looks something like:
Human / Organization
|
v
Authorization + Delegation
|
v
Agent Identity
(public key, certificate, DID, passport)
|
v
Capability Policy
(what it can access/do)
|
v
Runtime Authentication
(signatures, OAuth, mTLS, attestations)
|
v
Audit + Reputation
(who did what, when, under whose authority)
The biggest unresolved question is whether the winning model becomes:
open credential networks (DID/verifiable credential style),
agent certificates and registries (CA-like models),
or a hybrid where enterprises issue identities but agents carry portable proofs.
The companies above are effectively competing to become the “certificate authority,” “passport office,” or “OAuth layer” of the agentic internet.
Core bet: agent identity alone is insufficient; services need proof of authority.
Affinidi — decentralized identity for humans and agents
Affinidi applies self-sovereign identity concepts (DIDs, verifiable credentials) to AI agents, arguing that agents need portable identities that can move across systems rather than being tied to one platform.
Core bet: the agent should carry verifiable credentials, not borrow a human’s identity.
Dentity — reusable identity credentials
Dentity provides identity infrastructure built around reusable credentials and wallets, extending its model to AI agents and enterprise verification flows.
Core bet: identity should become a reusable asset rather than repeated database checks.
Agent authentication and access control
Stytch — developer authentication primitives
Stytch has been extending modern authentication infrastructure toward agent-related workflows, including delegated authorization patterns.
Core bet: developers will need agent-aware authentication APIs, not just human login flows.
WorkOS — enterprise identity plumbing
WorkOS focuses on enterprise authentication infrastructure (SSO, directory sync, access controls) and is among the companies adapting identity infrastructure for agent-era enterprise environments.
Core bet: companies will need to manage agents like employees and service accounts.
Fidea — agent identity and policy enforcement
Fidea positions itself as an identity and access layer for AI agents, emphasizing credential isolation, observing agent calls, and enforcing policies.
Core bet: agents need their own credentials rather than borrowing user tokens.
Agent certificates, attestation, and “Know Your Agent”
AgentPass — cryptographic passports for agents
AgentPass is building certificate-style identity for AI agents, including signed identities and trust levels.
Core bet: agents will need something analogous to website certificates or employee badges.
IDevSec — open trust protocols
IDevSec is developing cryptographic identity and attestation infrastructure for agents, including the Creduent Protocol.
Core bet: open protocols may win over proprietary agent registries.
WIDTH — KYA (Know Your Agent)
WIDTH is focused on agent identity, capability attestation, and accountability — essentially extending KYC/KYB concepts to autonomous software.
Core bet: enterprises will need to know not just “who is the customer?” but “which agent is acting, under whose authority, with what permissions?”
Incumbents likely to shape the market
Startups are not alone. Major identity vendors are adapting:
okta.com — through its identity platform and investments, including interest in agent trust infrastructure.
microsoft.com — developing agent identity and lifecycle management capabilities for enterprise environments.
As autonomous AI agents, copilots, and multi-system digital workers evolve from chat-based assistants into actors that execute transactions, invoke APIs, and handle workflows, traditional identity frameworks (designed for humans clicking buttons or basic backend microservices) are breaking down.
Production environments can no longer rely on shared service accounts, static API keys, or DIY OAuth without inviting severe "confused deputy" risks or token drift. The emerging architecture requires two-identity modeling —knowing both the human user initiating a task and the specific cryptographic identity of the agent executing it, bound together by context-aware, short-lived runtime authorizations.
Several innovative startups and platforms are defining this new perimeter for identity, trust, and authentication in an agentic web:
Aembit — Specializes in Identity and Access Management (IAM) for AI agents and non-human workloads. It replaces static secrets with conditional access policies that evaluate runtime context (such as security posture) and utilizes a "blended identity" model alongside an MCP (Model Context Protocol) Identity Gateway to maintain strict attribution between the user and the executing agent.
Arcade.dev — Focuses specifically on production agent authentication and execution. It handles the dual-identity problem by providing a runtime that manages delegated context, per-action permission intersections, token vaults with auto-refresh, and structured audit logs tailored explicitly for LLM-driven actions.
Oasis Security — Built to manage Non-Human Identities (NHIs) and Agentic Access Management. Oasis covers the complete lifecycle governance of AI agents across enterprise SaaS and cloud environments, protecting against over-privileged agentic access and hidden token drift.
Entro Security — Provides a dedicated security and detection platform focused on non-human identities, secrets, and AI agents. Entro helps enterprises map, monitor, and govern how autonomous workers and machine identities interact with internal systems.
Composio — While functioning heavily as an integration and tool-calling layer for AI agents, it addresses the critical trust bottleneck of secure tool authorization, handling granular user-delegated authentication across hundreds of enterprise apps.
Would you like to explore how the Model Context Protocol (MCP) handles security at the protocol level, or dive deeper into cryptographic keypair attribution (like Ed25519) for agent auditing?
As AI agents transition from chat-based assistants to autonomous actors that execute API calls, manipulate records, and negotiate across systems, traditional identity and access management (IAM) built for human users is breaking down.
A new wave of specialized infrastructure startups is emerging to tackle Non-Human Identities (NHIs) , multi-protocol authentication, and scoped runtime trust for agentic systems.
Aembit : Positions itself explicitly as Identity and Access Management (IAM) for agentic AI. Unlike standard microservice authenticators, Aembit handles the "multi-protocol authentication gap" where a single agent task might juggle an LLM API key, an enterprise OAuth token, a cloud database connection, and a Model Context Protocol (MCP) token simultaneously. It brokers these credentials dynamically based on contextual runtime policies.
Scalekit : Built from the ground up for an AI-first world rather than retrofitting legacy consumer/enterprise login flows. Scalekit provides developers with modular blocks to authenticate AI agents alongside optional human-in-the-loop authorization, helping platforms manage agent actions inside business software without over-privileged shared keys.
Agentic Fabriq : A Y Combinator-backed startup focused on operationalizing agent trust in enterprise environments. It assigns individual, verifiable identities to corporate AI agents, wrapping them with scoped permissions, real-time approval flows, and deep audit logs to replace brittle one-off integrations.
Because AI agents operate autonomously via service accounts, tokens, and API secrets, they merge heavily with the broader Non-Human Identity security category.
Oasis Security : Offers an enterprise platform combining NHI discovery and lifecycle governance with Agentic Access Management . Oasis monitors where agents live (across IaaS, SaaS, and internal tools like GitHub or Salesforce), provisions them securely from day one, and uses context-aware tools like Oasis Scout to filter behavioral noise from active breach attempts.
Entro Security : Focuses heavily on the secrets, tokens, and connectivity pipelines utilized by AI agents and automated machine workloads. It provides continuous detection and posture management specifically for non-human access vectors.
Key Architectural Shifts These Startups are Solving
Multi-Protocol Hopping: Traditional tools see one workload, one protocol. Agents hop across 4 to 5 distinct token standards in a single workflow execution, requiring unified policy layers.
Dynamic Delegation ("Acting On Behalf Of"): An agent isn't just acting as itself; it inherits a constrained subset of a human user's permissions. Managing delegated trust and async human confirmation (such as OAuth/CIBA flows) is a core problem these startups address.
Beyond Shared API Keys: Moving enterprise workflows away from static, over-broader service accounts toward short-lived, identity-scoped, and heavily audited agent credentials.
Would you like to dive deeper into how standards like Model Context Protocol (MCP) are changing authentication, or explore how legacy giants like Okta and Microsoft Entra are competing with these startups?
Yes. The interesting thing is that “agent identity” is becoming a distinct layer above ordinary IAM: an agent needs its own identity, but also needs to prove which human/org authorized it, what it is allowed to do, and whether its behavior remains trustworthy.
As of 2026, I’d map the startup landscape into roughly five camps:
1. Agent-native identity & authorization
Keycard — building access infrastructure around dynamic tokens and federated identity for AI agents. The key idea is that an agent should receive narrowly scoped, dynamically controlled access rather than inherit a user's credentials.
Descope — extending customer IAM into agents and MCP servers, with authentication, authorization and flow management.
Stytch — one of the more credible developer-facing plays: agent authentication, delegated authorization, consent, MCP security and agent abuse detection.
Prefactor — focused on an identity/control plane for agents, particularly authentication and auditable access to MCP servers.
Astrasync AI — more explicitly pursuing an ecosystem-level identity layer: registration, verification and trust scoring for agents.
2. Proving who authorized the agent
This may ultimately be the most important category.
Proof is particularly interesting. Its x401 protocol is designed so a website/API can ask an agent to prove the authority behind an action—for example, verified identity, organizational affiliation, signing authority, age, or another trusted claim.
That is a subtly different problem from “authenticate this agent.” It's:
“Authenticate this agent, and prove the principal and authority chain behind this particular action.”
That distinction becomes crucial when an agent is buying something, signing a contract, moving money, or accessing corporate data.
Prove is taking another route: persistent identity + verification + authentication + fraud prevention for people, businesses and agents.
3. Agent trust / reputation
This is the layer I think is most underdeveloped—and potentially most valuable.
SecureAuth has introduced an Agent Trust Registry containing verified agent identity, trust scores and governance metadata.
The emerging question is:
“I know which agent this is. Should I trust this agent enough to let it do X?”
That's analogous to the web's certificate/reputation infrastructure, except the subject isn't a server or human—it's an autonomous software actor.
4. Enterprise non-human identity
A number of startups are attacking the problem from the enterprise-security side rather than consumer/web identity.
The interesting names include Archestra, Geordie AI, Agentic Fabriq, and Pomerium, among others. Their common thesis is that agents are effectively a new class of non-human identity that needs discovery, permissions, policy enforcement, secrets, monitoring and revocation.
This market is already getting crowded with incumbents: the 2026 landscape has seen substantial acquisition activity around agent/non-human identity, which suggests large security vendors view this as a control-plane market rather than a niche feature.
5. The existing IAM companies becoming agent infrastructure
Don't underestimate this group.
Okta, Stytch, WorkOS, Auth0, and others are adapting OAuth, SSO, delegated authorization and machine identity to agents. Okta, for example, is building a Cross App Access ecosystem specifically around agent-to-app and app-to-app connections.
This matters because the winner doesn't necessarily need to invent a new identity primitive. OAuth + cryptographic keys + delegated authorization + verifiable claims may be enough; the new part is composing them around autonomous actors.
My shortlist
If I were trying to understand who might define the “identity layer of the agentic web,” I'd put these on the watchlist:
Startup
Core bet
Why it matters
Proof
Proof of human/principal authority
Could become the “who authorized this?” protocol
Keycard
Agent access/identity
Agent credentials and dynamic authorization
Stytch
Agent auth + consent
The really interesting architectural question, though, is whether these remain separate markets.
I suspect the eventual stack looks something like:
Human / organization
↓
Delegated authority (“this agent may act for me”)
↓
Agent identity (“this specific software actor is Agent X”)
↓
Credential / authorization (“Agent X may do Y, but not Z”)
↓
Trust / reputation (“Agent X has a history of behaving acceptably”)
↓
Transaction / API request
↓
Continuous verification + revocation
That's considerably richer than today's “user logs in → receives bearer token” model. Stripe's agent-auth discussions explicitly point at the same transition: agents can't safely inherit human credential models; delegated identity and scoped permissions become necessary.
And the market is moving quickly enough that Visa, Mastercard and Ant International are now working on common standards for identifying and verifying agents in commerce, which is a strong signal that agent identity is becoming an actual internet infrastructure category rather than merely an IAM feature.
If you're looking at this from a startup/investment angle, my strongest thesis is that “agent identity” itself may be commoditized, while the really defensible layer is verifiable authority + trust + reputation: not “who is this bot?” but “who stands behind this bot, what exactly did they authorize, and why should I trust it?”
Yes. The interesting market is emerging around a new identity stack for an agentic web—where the “user” may be an autonomous software agent acting under delegated authority.
My shortlist, as of September 2026:
The startups I’d watch most closely
Proof — probably the clearest pure-play bet on the “who authorized this agent?” problem. Its x401 protocol lets a website/API request cryptographic proof of the authority behind an agent, including identity, organizational affiliation, signing authority, age, membership, or humanness.
Stytch — interesting because it is extending mainstream developer authentication into agent OAuth and delegated authorization rather than inventing an entirely separate identity stack.
Pomerium — strong on the authorization / zero-trust side: treating agents as identities that need controlled access to internal resources rather than simply issuing them API keys.
Persona — important if the problem becomes “prove the human/business behind the agent.” Its existing KYC/KYB infrastructure maps naturally onto agent principals and delegated commerce.
Token Security / Token2 — worth watching for machine/agent-specific authentication and identity-as-code.
Unforge — an explicitly agent-native approach: persistent, auditable identities for individual agents, including delegation chains and runtime authorization.
AFAuth — one of the more interesting protocol-native experiments: giving an agent a cryptographic identity that can be linked to a verified human without exposing PII.
There is also a potentially important open-protocol layer emerging around this market. AgentID, AITP and similar projects are trying to answer “which agent is this, who is accountable for it, and what can it do?” rather than merely authenticating the application running the agent.
But don't overlook the incumbents
The biggest competitive threat to these startups is that identity vendors already own the enterprise trust fabric.
Auth0/Okta is adding agent-specific identity and authentication capabilities.
Microsoft Entra now explicitly supports multiple agent identity models: agents acting on behalf of users, autonomous agents, and agents with their own user principals.
Cisco Duo is building agent discovery, lifecycle identity, accountable ownership and least-privilege authorization into its enterprise security stack.
is positioning persistent identity verification and fraud prevention as a trust layer spanning people, businesses and AI agents.
That makes the competitive landscape unusually interesting: the winning company may not be the one that invents “agent authentication,” but the one that becomes the trust broker between an agent, its principal, and the service it wants to use.
The stack I think is forming
I'd break the market into five layers:
Layer
Question
Companies / projects
Agent identity
“Which agent is this?”
Unforge, AgentID, AFAuth
Principal binding
“Who owns/authorized it?”
Proof, Persona, Prove
Authentication
“Can I cryptographically verify it?”
The last layer is accelerating particularly quickly. Visa, Mastercard and Ant International just announced work on a common framework for identifying and verifying AI agents making purchases, while India's NPCI is developing an agent registry for authenticated agentic payments.
The really important distinction
I wouldn't frame this market as simply “Auth0 for AI agents.”
The fundamental primitive is closer to:
Agent identity = agent + principal + delegation + capability + provenance + revocation
A human login answers “who are you?”
An agent transaction needs to answer:
Which agent? → acting for whom? → authorized by whom? → authorized to do what? → within what limits? → using which delegated credentials? → can I hold someone accountable afterward?
That's why I think Proof, Stytch, Pomerium, Persona and the agent-native identity protocols are particularly worth tracking.
And the standards race is real: an IETF draft on AI-agent authentication/authorization is explicitly trying to adapt OAuth 2.0 and workload identity rather than create an entirely parallel authentication universe, while FIDO has established an Agentic Authentication working group.
If I were building an investment/startup landscape, my highest-conviction “watch list” would be Proof, Stytch, Pomerium, Persona, Unforge and AFAuth—with Auth0/Okta and Entra as the incumbents most likely to absorb a lot of the horizontal market.
As AI agents evolve from passive assistants to autonomous actors that execute transactions, query proprietary databases, and call APIs on behalf of users, legacy Identity and Access Management (IAM) built for humans is breaking down. Traditional infrastructure assumes a human is clicking buttons or a static microservice has a fixed scope.
A new wave of startups and platforms is building the foundational layers for Non-Human Identities (NHIs) , agentic authorization, and contextual trust.
Aembit: Focuses on IAM specifically for agentic AI and software workloads. Instead of relying on static API keys or over-permissioned service accounts, Aembit brokers credentials dynamically, evaluates contextual access policies, and issues temporary, just-in-time access rights for agents interacting with cloud, SaaS, and on-prem services.
Scalekit: Built from the ground up for an AI-first world rather than retrofitting human identity tools. Scalekit offers modular developer infrastructure to authenticate AI agents, manage delegated permissions, and handle human-in-the-loop approval triggers when an agent needs authorization to execute high-stakes enterprise actions.
Oasis Security: A pioneer in Non-Human Identity management that automated the discovery, lifecycle governance, and threat detection for autonomous agents and machine identities across complex cloud environments. (Note: Oasis was acquired by Cyera to scale data-centric NHI security, highlighting how critical this layer has become).
Astrix Security: Specializes in non-human identity security and third-party integration governance. As AI agents proliferate and connect to external tools, Astrix maps and monitors how these agentic connections access enterprise data, mitigating privilege creep and unauthorized lateral movement.
Entro Security: Focuses heavily on the deep discovery, hardcoded secret detection, and runtime monitoring of non-human identities, service accounts, and AI agents to ensure they don't operate outside compliant boundaries.
Emerging Architectural Pillars for Agentic Trust
These startups are shifting the security paradigm away from static passwords and OAuth tokens toward four core concepts:
Agent as Principal: Treating AI agents as first-class, accountable identities rather than masking their actions under a human user's session or a broad, shared service account.
Just-In-Time (JIT) & Contextual Auth: Swapping long-lived API secrets for ephemeral, task-specific permissions that expire the moment the agent completes a specific micro-workflow.
Delegated Authority & Guardrails: Embedding programmatic "pause" buttons where an agent must ping a human supervisor or secondary policy engine to approve sensitive actions (like moving funds or writing production code).
Continuous Audit Trails: Logging every autonomous decision chain and API call made by an agent to maintain traceability and meet regulatory compliance.
Would you like to explore how enterprise giants (like Okta or Microsoft Entra) are competing with these startups, or dive deeper into the technical mechanics of Agent-to-Agent (A2A) authentication protocols?
As autonomous AI agents shift from passive chat interfaces to active participants—executing API calls, moving across Model Context Protocol (MCP) servers, managing corporate workflows, and initiating agentic commerce—traditional identity and access management (IAM) breaks down. A model cannot simply act as a blank-slate security boundary, and sharing long-lived API secrets with transient runtime environments invites catastrophe.
An emerging ecosystem of startups, protocols, and developer platforms is defining how agents prove who they are, what human or organization they represent, and how they can be trusted with execution rights.
Delegated Authority & Verifiable Credentials
Truvera (by Dock Labs): Truvera is tackling portable agent identity and agentic commerce . Through Truvera Agent ID , it leverages W3C verifiable credentials to cryptographically bind an AI agent to its controlling human or organization. Rather than giving an agent a standing password, users issue a delegated-authority credential that explicitly details authorization scope, limits (e.g., spending limits or specific merchant access), and context. Merchants or APIs can verify these credentials via an API call in real-time, allowing for instant and global credential revocation.
Workload, MCP, and "Blended" Identity Brokers
Aembit: Aembit operates as an independent identity broker engineered heavily around modern workload and agentic architectures—including security for Model Context Protocol (MCP) servers. Aembit pioneered a Blended Identity framework that binds an AI agent's unique verifiable identity back to the human user who triggered it, generating a unified trace for every action. Their MCP Identity Gateway handles dynamic token exchange and delivers short-lived secrets just-in-time per task, meaning the agent runtime never actually stores or handles raw master credentials.
Web3, Cryptographic Proofs, and On-Chain Reputation
Reclaim Protocol: As agents browse the web or interact with traditional web infrastructure on behalf of users, Reclaim generates zero-knowledge and cryptographic proofs directly from source websites. This allows an agent to prove things about a user or its own operational state (e.g., employment status, historical data, API validation) without exposing underlying sensitive credentials or data.
Ethos & Talent Protocol: Operating on chains like Base, protocols like Ethos and Talent Protocol are establishing decentralized, stake-backed reputation systems. In an agent-first web, malicious automated entities or Sybil swarms must be filtered out by cryptographically verifiable reputation scores and slashed stakes rather than traditional email-based signups.
Descope & Auth0: While legacy giants like Microsoft Entra Agent ID and Okta dominate massive corporate governance for internal enterprise bots, developer-focused auth platforms like Descope are building native workflows for customer-facing agentic applications. They handle session hijacking prevention, continuous risk assessment, and contextual multi-factor assertions specifically tailored for non-human interactive loops.
If you're architecting an agentic workflow right now, let me know:
Are you building agent-to-agent commerce , or internal tool execution (via MCP)?
Do you need human-in-the-loop delegation or fully autonomous execution?
I can dive deeper into how these authorization patterns apply to your stack.
The “agentic web” creates a new identity stack problem: humans authenticate to services today, but tomorrow services will authenticate to agents acting on behalf of humans, companies, and other agents. The emerging winners are likely to own some combination of:
Agent identity — “What is this agent?”
Delegation — “Who authorized it, and under what authority?”
Authentication — “Can I cryptographically verify this actor?”
Authorization — “What can it do right now?”
Trust/reputation — “Should I allow this agent into my system?”
Auditability — “What happened and who is accountable?”
A few startups and emerging platforms are shaping this layer:
Agent-native identity and authorization
Proof
proof.com is building around the idea that websites and APIs need proof of who authorized an agent’s action, not just proof that a request came from a valid API key. Its x401 protocol focuses on verifying authority behind agent actions.
Thesis: The missing primitive is not “agent login”; it is verifiable delegation.
Arcade.dev
arcade.dev focuses on secure agent tool use: separating an agent’s reasoning from its ability to execute actions, with policy enforcement around tool calls, permissions, and auditing.
Thesis: Agents should never receive broad credentials; they should receive narrow, policy-controlled capabilities.
Alter
alterauth.com is building zero-trust identity and access control specifically for AI agent workflows, including ephemeral credentials and fine-grained authorization.
Thesis: IAM needs to move from “users and service accounts” to “every autonomous actor.”
Descope
descope.com has extended modern authentication flows toward AI agents and machine actors.
Thesis: Existing identity providers have a head start because enterprises already trust them.
Identity infrastructure companies extending into agents
Okta /
Auth0 is extending OAuth-style identity infrastructure toward agent scenarios, including delegated authorization patterns.
Strength: Massive installed base of developers and enterprises.
Risk: Agent identity may require deeper primitives than traditional human IAM.
Stytch
stytch.com is adapting developer-first authentication infrastructure toward agent authorization use cases.
Strength: API-native identity tooling.
WorkOS
workos.com is positioned around enterprise identity integrations and is part of the broader shift toward agent-aware enterprise access.
Strength: Enterprise adoption and SSO/SCIM expertise.
Cryptographic identity, credentials, and trust networks
Dentity
dentity.com is building reusable identity infrastructure based on verifiable credentials, decentralized identifiers, and identity wallets, including support for AI agent identities.
Thesis: Identity should become a portable credential, not a database lookup.
Indicio
indicio.tech is applying verifiable credential infrastructure to agent identity, including its ProvenAI work.
Thesis: Agents need the same kind of verifiable claims humans use: ownership, authorization, and provenance.
WISeKey
wisekey.com is developing agent identity and control infrastructure through WISeID Keystone, using PKI-based approaches.
Thesis: Public-key infrastructure may become the certificate layer for autonomous software.
New categories emerging
Agent registries and discovery layers
The agent web may need something like DNS + certificates + reputation.
Linux Foundation has announced work around an Agent Name Service concept: a trusted identity/discovery layer for agents.
Possible future primitives:
Agent names
Ownership records
Capability declarations
Reputation scores
Revocation mechanisms
My map of the market
Layer
Likely winners
Agent authentication
Auth0/Okta, Stytch, Descope, new cryptographic identity startups
Delegated authority
Proof, Arcade.dev, Alter
Agent permissions
Teleport, , enterprise security vendors
The biggest strategic question is whether agent identity becomes an extension of human identity (“this agent represents Alice at Company X”) or a new Internet identity primitive (“this autonomous actor has its own portable reputation and credentials”). The startups above are mostly betting that the latter will be necessary.
A useful analogy: in the 1990s the web needed DNS + TLS + certificates; in the 2020s the agentic web likely needs agent naming + delegation + authorization + reputation. The companies that become the “certificate authorities” or “OAuth providers” for agents could become foundational infrastructure.
Alter
alterauth.com is building zero-trust identity and access control specifically for AI agent workflows, including ephemeral credentials and fine-grained authorization.
Thesis: IAM needs to move from “users and service accounts” to “every autonomous actor.”
Descope
descope.com has extended modern authentication flows toward AI agents and machine actors.
Thesis: Existing identity providers have a head start because enterprises already trust them.
Identity infrastructure companies extending into agents
Okta /
Auth0 is extending OAuth-style identity infrastructure toward agent scenarios, including delegated authorization patterns.
Strength: Massive installed base of developers and enterprises.
Risk: Agent identity may require deeper primitives than traditional human IAM.
Stytch
stytch.com is adapting developer-first authentication infrastructure toward agent authorization use cases.
Strength: API-native identity tooling.
WorkOS
workos.com is positioned around enterprise identity integrations and is part of the broader shift toward agent-aware enterprise access.
Strength: Enterprise adoption and SSO/SCIM expertise.
Cryptographic identity, credentials, and trust networks
Dentity
dentity.com is building reusable identity infrastructure based on verifiable credentials, decentralized identifiers, and identity wallets, including support for AI agent identities.
Thesis: Identity should become a portable credential, not a database lookup.
Indicio
indicio.tech is applying verifiable credential infrastructure to agent identity, including its ProvenAI work.
Thesis: Agents need the same kind of verifiable claims humans use: ownership, authorization, and provenance.
WISeKey
wisekey.com is developing agent identity and control infrastructure through WISeID Keystone, using PKI-based approaches.
Thesis: Public-key infrastructure may become the certificate layer for autonomous software.
New categories emerging
Agent registries and discovery layers
The agent web may need something like DNS + certificates + reputation.
Astrix Security : (Acquired by Cisco) Pioneer in securing non-human access, third-party integrations, and automated AI agent connections against credential leakage and over-permissioned blast radii.
Developer adoption / authentication layer
Descope
IAM for humans + agents + MCP
Bridges conventional IAM to agentic systems
Astrasync
Agent registry + trust
Potential reputation/discovery layer
Prefactor
Agent/MCP identity control plane
Infrastructure-level enforcement
Archestra
Agent security gateway
Runtime enforcement rather than just identity
Prove
Persistent verified identity
Human ↔ business ↔ agent trust chain
Prove
Auth0, Stytch, Microsoft Entra, Token
Authorization
“What may it do right now?”
Pomerium, Duo, Stytch
Transaction trust
“Can I safely let it buy/sign/pay?”
Proof, Visa, Mastercard, Experian
ZeroG (ERC-7857 / INFS): ZeroG has championed Intelligent NFTs (INFS) or agentic IDs , binding an NFT directly to an AI agent's logic and wallet. When ownership of the agent transfers, its state, history, and on-chain identity credentials transfer deterministically with it—laying groundwork for decentralized agent-to-agent payment and communication standards.
WorkOS
