Identity standards
In an agent world you need more than passwords. You need cryptographically verifiable identities that work across systems, support automation at scale, and meet compliance requirements.
Automentic is built on open standards rather than a proprietary identity format. That is a deliberate constraint: a bespoke format would make you dependent on us and would not survive an auditor's first question.
The core stack
Start here. These four are battle-tested and carry the majority of deployments.
OAuth 2.0
Modern, token-based authorisation. Gives agents and the people supervising them one governed path into every connected system, rather than a credential per integration.
OpenID Connect
The identity layer on top of OAuth 2.0. This is what Automentic uses to federate with your existing identity provider, so agents and approvers inherit your groups, policies and lifecycle rules. See Federate your identity provider.
X.509 certificates
Digital certificates for machines and agents. Each agent is issued one at provisioning, giving it a strong cryptographic identity anchored to a CA you can choose. See Agent identity.
Mutual TLS
Both client and server authenticate each other, rather than only the server proving itself. A target system can therefore refuse anything that cannot present a certificate you issued — the channel itself becomes an access control.
Enterprise federation
SAML 2.0
Enterprise federation, common in large organisations. Secure identity exchange with the directories and legacy systems that have not moved to OIDC. Automentic supports it for the same reason it supports OIDC: you should not have to migrate your IdP to adopt agent automation.
Cloud-native workload identity
SPIFFE / SPIRE
Workload identity for containers and services that are created and destroyed constantly. Identity is derived from the workload's properties rather than a secret placed on a host, so it survives autoscaling and redeployment.
Use where agents run as short-lived cloud-native workloads. See Agent identity.
Human oversight
FIDO2 / WebAuthn
Passwordless, phishing-resistant authentication using biometrics or security keys. Used for the humans who approve agent actions — the approval gate is worth protecting at least as well as the agents themselves.
Future-proofing
Verifiable Credentials and Decentralized Identifiers
W3C standards for portable, self-sovereign identity. Relevant where agent identity needs to be presented across organisational boundaries, or where the customer — not the vendor — must remain the authority over an identity.
Positioned as forward-looking rather than day-one: adopt where the use case genuinely calls for portability.
Recommended adoption order
- Start with the core stack — OAuth 2.0 with OIDC, X.509 and mutual TLS. Well understood, widely audited, and enough for most deployments.
- Add SPIFFE where workloads are cloud-native and short-lived.
- Add Verifiable Credentials where cross-boundary portability matters.
- Map the whole stack to your compliance frameworks — see Compliance mapping.
Throughout: never assume implicit trust. See Zero trust.
Summary
| Standard | Role in Automentic |
|---|---|
| OAuth 2.0 | Governed authorisation for agents and users |
| OpenID Connect | Federation with your existing IdP; SSO |
| SAML 2.0 | Federation with legacy enterprise directories |
| X.509 | Cryptographic identity per agent |
| Mutual TLS | Authenticated agent-to-system channels |
| SPIFFE / SPIRE | Workload identity for cloud-native agents |
| FIDO2 / WebAuthn | Phishing-resistant human approval |
| Verifiable Credentials / DID | Portable, customer-controlled agent identity |