Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Sameer Hiremath, Co-founder and SVP of Product & GM, Britive
OAuth, SAML, and OpenID Connect (OIDC) have quietly powered modern digital identity for more than a decade. They’ve enabled single sign-on, API integrations, and delegated access at internet scale. For human-driven applications with relatively stable permissions, they work remarkably well.
But a new class of actor is now entering enterprise systems: autonomous AI agents.
These agents don’t just authenticate and request data. They plan, decide, and act, often across multiple tools, systems, and data sources, without a human in the loop. And when agents begin acting independently, the assumptions behind OAuth-based authorization start to break down.
What OAuth Was Built to Do and What It Wasn’t
To understand the gap, it helps to clarify roles that are often conflated:
? SAML handles authentication: proving who a user is, typically for SSO.
? OAuth handles authorization: what a client is allowed to do, expressed through scopes.
? OIDC adds authentication back on top of OAuth.
Even OAuth’s client credentials flow, often described as “machine-to-machine,” assumes that permissions can be defined ahead of time, granted once, and reused safely across sessions. That model works for services with predictable behavior. Agentic AI systems behave very differently.
Why Agentic AI Breaks the OAuth Model
In a single workflow, an AI agent may interact with multiple Model Context Protocol (MCP) servers, APIs, databases, ticketing systems, and storage platforms. Pre-defining OAuth scopes that anticipate every possible action is either overly broad, or practically impossible.
Agents aren’t passive consumers of data. They make decisions and take actions. “Read-only” scopes don’t reflect reality, and broad scopes dramatically increase risk.
Static Consent vs. Dynamic Intent
OAuth scopes represent a user’s one-time consent. Agents, by contrast, operate on runtime intent. The “who,” “what,” “why,” and “for how long” can change from one action to the next.
A token issued hours ago can’t express the context of a decision made milliseconds ago.
APIs Are Only Part of the Surface Area
OAuth governs APIs. But agents increasingly need controlled access to non-API resources: data warehouses, object storage, file systems, internal tools, and legacy systems. OAuth simply doesn’t extend cleanly into these environments, leaving blind spots in access control.
MCP Exposes the Gap, It Doesn’t Create It
MCP enables agents to communicate with tools in a standardized way, but it doesn’t enforce security decisions. Without another control layer, OAuth tokens effectively become long-lived hall passes.
Consider a simple example:
An AI support agent needs to read a CRM case, write a ticket update, and attach a single log file from object storage.
OAuth scopes that allow CRM + ticketing + storage grant far more access than necessary. What’s actually needed is something much more precise: read this case, write this record, download this object, each for a short window, then revoke everything.
The Perimeter Has Shifted
As agents and automations become part of the workforce, identity and permissions become the new perimeter. Security can no longer rely on static authorization granted at session start.
What’s needed instead is runtime authorization.
Runtime Authorization: A Better Fit for Agentic Systems
Runtime authorization evaluates access at the moment of action, not ahead of time. It enables:
? Just-in-time, ephemeral permissions scoped to a single action and automatically revoked after a short TTL.
? Unified policy evaluation using identity, task, data sensitivity, environment, time, and risk signals.
? On-behalf-of boundaries, ensuring agents act only within the privileged perimeter of a human owner, with human-in-the-loop approvals for sensitive operations.
? Tool allows lists and conditional access, defining which tools an agent may call and under what circumstances.
? Agent identity registries and lifecycle management, establishing ownership, purpose, and visibility.
? Unified audit and rapid revocation, enabling immediate privilege teardown if behavior drifts.
Instead of trusting a token, each action is evaluated independently.
OAuth Still Matters But It Isn’t Enough Alone
OAuth isn’t obsolete. It remains valuable for delegated API access and consent-based interactions. But in agentic systems, OAuth should act as a transport mechanism, not the final authority.
The emerging pattern is OAuth plus runtime authorization:
? OAuth says: You may access this service.
? Runtime authorization says: For this specific action, right now, here’s the smallest permission required, and it will expire automatically.
The Payoff
Organizations that adopt runtime authorization for AI workflows gain:
? A dramatically smaller blast radius, with no always-on agent privileges.
? Cleaner, action-level audits instead of token-centric logs.
? Fewer surprises, as agents can’t escalate access on their own.
? Consistent controls across humans, non-human identities, and AI agents.
As AI agents move from experimentation into production, the question is no longer whether OAuth works, it’s whether it’s sufficient on its own. When agents act, authorization must keep up.
##
ABOUT THE AUTHOR
Sameer is an Identity and Access Management (IAM) industry expert with 20+ years experience in the US and India. Known for his ability to grow and manage product organizations while delivering innovative solutions for enterprises. Prior to joining Britive he led Optiv’s India operations.
