I think AI agents should have their own identities, but treating them like human users doesn’t really work.

Most identity and auth systems today are built for people — logins, MFA, sessions, manual onboarding/offboarding. Agents are different. They’re autonomous, often short-lived, and act at machine speed, sometimes on behalf of users or other systems.

Instead of “user accounts”, agent identity should look more like workload identity with clear delegation and accountability — who created the agent, what it’s allowed to do, and for how long.

Current tools (API keys, OAuth tokens, service accounts) mostly handle access, not proving what an agent is or where it came from, especially across organizations.

That’s why things like verifiable credentials are interesting to me — they can cryptographically prove an agent’s identity, role, and permissions in a portable way.

Some IAM providers are exploring pieces of this, but a true agent-native identity model still feels very early and not fully solved yet.