The ledger remembers what the market forgets. In the rush to deploy AI agents across the enterprise, we have forgotten the most basic lesson of the 2017 ICO era: unregulated access is a liability, not a feature. The CSA's finding that non-human identities now outnumber human employees by ratios of 90:1—sometimes reaching 144:1—is not a statistic. It is a systemic risk event waiting to be logged.
When Okta announced Agent SSO in August 2026, the market treated it as another product launch. It is not. This is the first serious attempt to impose order on the chaos of AI agent identity—and it signals a fundamental shift in how we must think about the intersection of identity infrastructure, cryptographic standards, and the emerging digital workforce.
Context: The Identity Layer Meets the Agent Economy
Okta's Agent SSO is built on the Extended Agent Authorization (XAA) framework, an extension of the OAuth 2.0 token exchange mechanism defined in RFC 8693. The technical architecture is not revolutionary—it is a combinatorial innovation that applies existing standards to a new problem domain. The core mechanism allows AI agents to obtain short-lived tokens to act on behalf of principals, replacing long-lived stored credentials that have become the Achilles' heel of non-human identity security.
The critical development is XAA's inclusion in the Model Context Protocol (MCP) as part of its Enterprise-Managed Authorization extension. This is the moment where the identity layer descends from the application level to the tool/agent communication layer. Any tool built on MCP can now reuse XAA identity information, creating a standardized approach to agent authentication across the ecosystem.
We do not build on hype; we build on consensus. The consensus here is that short-term tokens with automatic rotation are the correct security direction. This aligns with the broader industry trend toward ephemeral credentials—Google's BeyondCorp, AWS IAM Roles Anywhere, and the broader zero-trust movement all point in the same direction.
Core Analysis: The Open Core Strategy and Its Implications
Okta's commercialization strategy is textbook Open Core: the base XAA support is bundled free into the core SSO product, while advanced features—shadow AI discovery, access certification, and human owner assignment for non-XAA agents—are monetized as premium subscriptions.
This is a calculated move. By embedding Agent SSO into existing contracts, Okta eliminates procurement friction entirely. Enterprise customers do not need to renegotiate agreements or secure new budget lines. The feature simply appears in their existing dashboard. For a B2B SaaS company, this is the fastest possible path to market penetration.
The strategic genius lies in what this does to competitors. Pure-play AI identity startups—Clerk, WorkOS, and others—now face a free alternative from a company with 18,000+ enterprise customers and a mature Universal Directory. The pricing pressure is existential. The response will likely be consolidation: acquisition by larger players or a pivot to more vertical use cases.
But there is a hidden dimension to the free tier that deserves scrutiny. Free access means Okta gains visibility into enterprise AI agent behavior patterns. Not content, but metadata: call patterns, frequency, tool graphs, and interaction topologies. This data becomes the foundation for future security analytics and anomaly detection modules—a strategic asset that compounds over time.
The competitive landscape is a two-horse race. Microsoft Entra Agent ID leverages the Azure ecosystem's depth—500 million monthly active users, Copilot Studio integration, and Semantic Kernel compatibility. Okta's counter is neutrality: for enterprises running multi-cloud, multi-SaaS environments, Okta offers a vendor-agnostic alternative that Microsoft cannot match.
The alliance structure is telling. Anthropic's Claude Enterprise beta has named Okta as a featured identity provider through XAA. This is not a technical decision; it is a strategic move against Microsoft's OpenAI partnership. The agent identity standard war is the identity-layer projection of the AI model market share battle.
Contrarian Angle: The Neutrality Narrative Has a Blind Spot
The "open, vendor-neutral" framing of XAA deserves skepticism. Okta is the primary driver of the standard, and despite the 17+ ecosystem partners, the evolution of XAA remains tethered to Okta's product roadmap. True neutrality requires formal adoption by independent standards bodies—OIDF, IETF—through the RFC process. The article does not mention any such submission.
The separate pricing for non-XAA agents reveals a technical generation gap. Legacy agents require additional adaptation layers or reverse-engineering tools, which are more expensive and less compatible. This is not just a technical distinction; it is a sales lever designed to push customers from legacy agents toward the new standard.
There is also a concentration risk that the market is ignoring. When agent identities are centralized in Okta, Okta itself becomes a high-value target. A compromise of Okta's infrastructure would grant attackers control over thousands of agent identities simultaneously. The 2022 Okta security incident—where a third-party vendor breach exposed customer data—serves as a warning. The company's response to that incident will be the template for how it handles the next one, and the stakes are now exponentially higher.
Takeaway: Positioning for the Standardization Cycle
The market is in a sideways consolidation phase, but the positioning happening now will determine the next structural move. For investors and enterprises alike, the key metrics to track are not price charts but adoption signals: whether XAA gains formal RFC status, whether LangChain and CrewAI add native XAA support, and whether Microsoft's Entra Agent ID pricing forces a response.
The ledger remembers what the market forgets. The ICO era taught us that standards matter more than hype. The DeFi summer taught us that liquidity follows infrastructure. The NFT bubble taught us that utility trumps novelty. The agent identity market is following the same cycle—and Okta has placed its bet on becoming the standard-bearer.
The question is not whether Okta's technology works. It does. The question is whether the standard will hold against the gravitational pull of the Microsoft ecosystem. History suggests that open standards can win—but only when they offer demonstrable advantages over integrated platforms. The next 18 months will reveal whether XAA becomes the TCP/IP of agent identity or another proprietary protocol lost to platform dominance.
The digital workforce is arriving. The only question is who will control its identity layer.