The agent gets an identity: its own or the user's
Vendors decide whether an agent acts under its own identity or the signed-in user's, and wire that choice into sign-in and provisioning.
The pattern so far
Since July 2026 agents have stopped acting as anonymous integrations. Google gave agents a cryptographic identity, enterprise sign-in reached AI tools in August, and in September engagement vendors split between agents with their own traceable identity (Optimizely) and agents limited to the permissions of the person asking (Salesforce, Braze), with SCIM provisioning and ownership transfer as the administrative layer around them.
Trajectory
Month by month
- Accelerating Reconstructed
Identity became a design choice that ships. Optimizely gave each AI teammate its own traceable identity, Salesforce stated that every AIforce agent sees only what the person asking can see, and Braze took its remote MCP server to GA limited to the signed-in user's permissions, with SCIM group provisioning in GA. Google added ownership transfer for shared agents and OpenAI extended SCIM to API Platform organisations.
- Optimizely's Virtual Teammates each act under their own traceable identity.
- Every AIforce agent sees only what the person asking can see.
- Braze MCP access is limited by the signed-in user's permissions and OAuth scopes.
- SCIM provisioning for IdP groups from Okta and Entra ID to custom roles.
- Administrators can transfer ownership of shared agents; triggers stay off until the new owner enables them.
- Tenant-wide SCIM is extended to API Platform organisations and projects.
- Emerging Reconstructed
Enterprise sign-in reached AI tools. Antigravity accepted Gemini Enterprise accounts with admin controls, and Claude Desktop began signing in through the operating system's Microsoft account broker, so sign-in can satisfy Conditional Access policies that require a managed device.
Before it became a pattern
Early sightings that did not yet pass the entry rule on their own.