Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

A Novel Zero-Trust Identity Framework for Agentic AI: Decentralized Authentication and Fine-Grained Access Control

Ken Huang, Vineeth Sai Narajala, John Yeoh, Jason Ross, Ramesh Raskar, Youssef Harkati, Jerry Huang, Idan Habler, Chris Hughes

TL;DR

The paper argues that traditional IAM approaches (OAuth, OIDC, SAML) are ill-suited for autonomous AI agents operating in MAS due to dynamics like ephemerality, evolving capabilities, and complex delegation. It proposes a comprehensive Agent IAM framework built on Decentralized Identifiers (DIDs), Verifiable Credentials (VCs), Zero-Knowledge Proofs (ZKPs), and an Agent Naming Service (ANS), underpinned by a Unified Global Session Management layer and Zero Trust principles. The architecture encompasses end-to-end lifecycle management, secure discovery, fine-grained policy enforcement, JIT credential issuance, cross-protocol enforcement, and cryptographic auditability, with MAESTRO-based security analysis and governance models. The work identifies open challenges in scalability, standardization, governance, privacy, and UX, and outlines future work to realize trusted, auditable, and privacy-preserving agent ecosystems at scale.

Abstract

Traditional Identity and Access Management (IAM) systems, primarily designed for human users or static machine identities via protocols such as OAuth, OpenID Connect (OIDC), and SAML, prove fundamentally inadequate for the dynamic, interdependent, and often ephemeral nature of AI agents operating at scale within Multi Agent Systems (MAS), a computational system composed of multiple interacting intelligent agents that work collectively. This paper posits the imperative for a novel Agentic AI IAM framework: We deconstruct the limitations of existing protocols when applied to MAS, illustrating with concrete examples why their coarse-grained controls, single-entity focus, and lack of context-awareness falter. We then propose a comprehensive framework built upon rich, verifiable Agent Identities (IDs), leveraging Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs), that encapsulate an agents capabilities, provenance, behavioral scope, and security posture. Our framework includes an Agent Naming Service (ANS) for secure and capability-aware discovery, dynamic fine-grained access control mechanisms, and critically, a unified global session management and policy enforcement layer for real-time control and consistent revocation across heterogeneous agent communication protocols. We also explore how Zero-Knowledge Proofs (ZKPs) enable privacy-preserving attribute disclosure and verifiable policy compliance. We outline the architecture, operational lifecycle, innovative contributions, and security considerations of this new IAM paradigm, aiming to establish the foundational trust, accountability, and security necessary for the burgeoning field of agentic AI and the complex ecosystems they will inhabit.

A Novel Zero-Trust Identity Framework for Agentic AI: Decentralized Authentication and Fine-Grained Access Control

TL;DR

The paper argues that traditional IAM approaches (OAuth, OIDC, SAML) are ill-suited for autonomous AI agents operating in MAS due to dynamics like ephemerality, evolving capabilities, and complex delegation. It proposes a comprehensive Agent IAM framework built on Decentralized Identifiers (DIDs), Verifiable Credentials (VCs), Zero-Knowledge Proofs (ZKPs), and an Agent Naming Service (ANS), underpinned by a Unified Global Session Management layer and Zero Trust principles. The architecture encompasses end-to-end lifecycle management, secure discovery, fine-grained policy enforcement, JIT credential issuance, cross-protocol enforcement, and cryptographic auditability, with MAESTRO-based security analysis and governance models. The work identifies open challenges in scalability, standardization, governance, privacy, and UX, and outlines future work to realize trusted, auditable, and privacy-preserving agent ecosystems at scale.

Abstract

Traditional Identity and Access Management (IAM) systems, primarily designed for human users or static machine identities via protocols such as OAuth, OpenID Connect (OIDC), and SAML, prove fundamentally inadequate for the dynamic, interdependent, and often ephemeral nature of AI agents operating at scale within Multi Agent Systems (MAS), a computational system composed of multiple interacting intelligent agents that work collectively. This paper posits the imperative for a novel Agentic AI IAM framework: We deconstruct the limitations of existing protocols when applied to MAS, illustrating with concrete examples why their coarse-grained controls, single-entity focus, and lack of context-awareness falter. We then propose a comprehensive framework built upon rich, verifiable Agent Identities (IDs), leveraging Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs), that encapsulate an agents capabilities, provenance, behavioral scope, and security posture. Our framework includes an Agent Naming Service (ANS) for secure and capability-aware discovery, dynamic fine-grained access control mechanisms, and critically, a unified global session management and policy enforcement layer for real-time control and consistent revocation across heterogeneous agent communication protocols. We also explore how Zero-Knowledge Proofs (ZKPs) enable privacy-preserving attribute disclosure and verifiable policy compliance. We outline the architecture, operational lifecycle, innovative contributions, and security considerations of this new IAM paradigm, aiming to establish the foundational trust, accountability, and security necessary for the burgeoning field of agentic AI and the complex ecosystems they will inhabit.

Paper Structure

This paper contains 47 sections, 5 figures, 2 tables.

Table of Contents

  1. Introduction
  2. The Imperative for a New Agentic IAM Paradigm
  3. Revisiting Traditional IAM
  4. Lingering Utility for Constrained Scenarios
  5. Fundamental Insufficiencies for Multi-Agent Systems (MAS)
  6. Unique Challenges Posed by Agentic AI in MAS Further Exacerbating IAM Deficiencies
  7. Defining the Agent Identity (Agent ID) for a New Era
  8. What Constitutes an AI Agent's Identity? Beyond Static Identifiers
  9. Essential Components of an Agent ID
  10. Agent ID Ownership and Control
  11. ID Generation, Assignment, and Lifecycle Management: From Birth to Revocation
  12. The New Agentic AI Identity and Access Management Framework Architecture
  13. Foundational Pillars
  14. Core Architectural Layers
  15. Applying Zero Trust Principles
  16. ...and 32 more sections

Figures (5)

  • Figure 1: Core Architecture and its layers
  • Figure 2: Agent discovery process using the Agent Name Service (ANS)/
  • Figure 3: Fine-grained access control enforcement when RiskAnalyzerBot requests access to sensitive financial data.
  • Figure 4: Ephemeral agent authorization using Just-In-Time (JIT) Verifiable Credentials for Model Context Protocol (MCP) tool access.
  • Figure 5: Secure agent-to-agent communication using Google's A2A protocol for critical security alerts.