Good plumbing, wrong name - Okta ships MCP's enterprise auth free and the token still carries a person

Okta's Agent SSO reached general availability on 24 August 2026 and is included in core Okta SSO at no additional cost: an AI agent supporting Cross App Access is registered as a first-class identity in Universal Directory alongside human employees and receives short-lived, identity-governed tokens in place of stored credentials. The obvious reading, that agent identity is now a solved and free problem, needs two corrections. First, this is not a new standard - Cross App Access was incorporated into MCP as the Enterprise-Managed Authorization extension on 25 November 2025 and sits in the specification's stable directory, so what shipped in August was distribution and price. Second, the flow delegates human authority: the client exchanges an ID token for an Identity Assertion JWT Authorization Grant and then for an access token, and the specification directs authorization servers to map IdP claims to permissions, use the subject claim "as the primary stable identifier for the user", and determine "who the employee is and what the employee can access". The agent gets a directory row; the token still carries a person. The extension names compliance among its own reasons to adopt - "an auditable authorization trail for all MCP server access" - but an authorization trail is not a record of processing: GDPR Article 30(1)(b) asks for the purposes of the processing, and an ID-JAG states only that an employee was permitted to reach a server at a time. The practitioner move is to adopt it for the genuine Article 32 value of immediate cross-client revocation and the retirement of stored credentials, while writing purpose alongside scope somewhere a DPIA can cite, and starting six-month log retention before Article 26(6) requires it of Annex III deployers from 2 December 2027.

Post

Okta made agent identity free three days ago. The interesting part is what the token still says.

On 24 August, Agent SSO went GA inside core Okta SSO at no extra cost. An AI agent supporting Cross App Access is registered as a first-class identity in Universal Directory — alongside human employees — and gets short-lived, identity-governed tokens instead of stored credentials. Okta's own survey, fielded in March, found 92% of executives already running autonomous agents and 34% applying the same security controls to them as to people.

Three things before you file this as solved.

  1. It is not a new standard. Cross App Access was incorporated into MCP as the Enterprise-Managed Authorization extension on 25 November 2025. It sits in the specification's stable directory. What shipped in August was the price.

  2. The flow is delegated human authority. The client exchanges an ID token for an Identity Assertion JWT Authorization Grant, then trades that for an access token. The specification tells server implementers to map IdP claims to permissions and use the subject claim to work out "who the employee is and what the employee can access".

The agent gets a row in the directory. The token still carries a person.

  1. The extension names compliance in its own reasons to adopt: "your organization needs an auditable authorization trail for all MCP server access."

An authorization trail is not a record of processing. GDPR Article 30(1)(b) asks for the purposes of the processing. An ID-JAG says employee X was permitted to reach server Y at 09:14. It does not say what the agent did there, or why.

What I would do Monday:

  1. Turn it on. Revocation that takes effect immediately across every client is real Article 32 value, and it retires stored credentials.
  2. Do not let the token trail become your record. Write the purpose next to the scope, somewhere a DPIA can cite.
  3. Decide who the accountable actor is when the subject claim belongs to an employee who was asleep.
  4. Start six-month log retention before Article 26(6) makes you. Annex III high-risk applies from 2 December 2027.

Agent SSO answers who asked. Article 30 asks what for.

Which of your agents can answer the second one?

#AIAct #DSGVO #AgenticAI #MCP #IdentitySecurity

First comment

Sources.

Okta's own press release — Agent SSO, GA 24 August 2026, included in core SSO at no additional cost, and the sentence about registering the agent "as a first-class identity in Universal Directory alongside human employees": https://www.okta.com/newsroom/press-releases/okta-brings-first-class-identity-to-ai-agents-with-agent-sso/

The MCP Enterprise-Managed Authorization extension page — the ID-JAG flow, the instruction to map IdP claims to permissions, and the "auditable authorization trail" line in its own reasons to adopt: https://modelcontextprotocol.io/extensions/auth/enterprise-managed-authorization

Okta's article announcing that Cross App Access had been incorporated as that extension, dated 25 November 2025 — this is where the nine-month gap comes from: https://www.okta.com/newsroom/articles/cross-app-access-extends-mcp-to-bring-enterprise-grade-security-to-ai-agents/

SEP-990, the original proposal to enable enterprise IdP policy controls during MCP authorization: https://modelcontextprotocol.io/seps/990-enable-enterprise-idp-policy-controls-during-mcp-o

AI Agents at Work 2026, published 27 May 2026 — the 92% and 34% figures, from 292 executives and 492 knowledge workers across seven countries, fielded March 2026. Vendor research; read it as such: https://www.okta.com/newsroom/articles/ai-agents-at-work-2026-agentic-enterprise-security/

GDPR Article 30, records of processing activities: https://www.privacy-regulation.eu/en/30.htm

AI Act Article 26, deployer obligations, including the six-month log retention floor in paragraph 6: https://artificialintelligenceact.eu/article/26/

One point cut for length: the extension is opt-in and never active by default, and client support varies. So "we have adopted Enterprise-Managed Authorization" is a statement about your identity provider, not about your agents. Every MCP client in the estate that has not implemented the extension carries on doing per-user OAuth exactly as before — and those are precisely the ones the admin console will not list.

Claims

Sources

Corrections

  • Took the general-availability date from Okta's own press release (24 August 2026), not from the aggregator listings that placed it on 26 August. A coverage date is not an event date.
  • Did not present Cross App Access or Enterprise-Managed Authorization as new. Okta's own article dates the incorporation into MCP to 25 November 2025, nine months before the August release; the extension lives under specification/stable/.
  • Attributed the 92% and 34% figures to Okta's own AI Agents at Work 2026 report, named its publication date (27 May 2026) and its March 2026 fielding, and graded it secondary rather than primary: Okta sells the product the survey motivates.
  • Dropped two figures from that report as unsafe. Its widespread/moderate split is given as 58% and 35%, summing to 93% against a stated 92%; and 58% appears separately as the share of executives reporting an AI-related security issue. A repeated figure with two meanings is a conflation risk, so neither sub-figure is used.
  • Used artificialintelligenceact.eu only for the verbatim text of Article 26(1) and 26(6). No date in this edition comes from that site, whose implementation-timeline pages were found stale in a previous edition. The 2 December 2027 Annex III date is carried from CLAIM-2026-08-23-08, verified against Regulation (EU) 2026/1744 on EUR-Lex.
  • Reused the existing cite key euartificia2026article for the Article 26 page (same URL, already archived) and issued a new key privacyregu2016records for GDPR Article 30, because the existing privacyregu2016article points at Article 25 and cite keys must not be overloaded.
  • The reading that a directory identity and a user-subject token are different things is presented as the edition's argument from quoted specification text, not as a separate verified claim about Okta's implementation.

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice and the cover art is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.