The next generation of AI systems will not be judged only by whether agents can complete tasks. It will be judged by whether those tasks can be completed without handing autonomous software unrestricted control over the credentials that make action possible.
October 2026 brought several noteworthy developments. On October 22, 1Password announced a way for supported agents to request approved sign-ins without receiving the stored password. On October 26, IBM made Agent Identity generally available, connecting agent registration, delegation, policy enforcement and credential governance. On October 27, NIST published ten proposed design tenets for agent identity management. A revised individual Internet-Draft, published October 17, describes a possible agent-to-wallet interface for digital credentials.
These are different products, proposals and stages of maturity. Their convergence is nevertheless useful: the system deciding what to attempt should not automatically control the keys that permit it.
Authentication is not permission to perform any action
A session can be authenticated and still be unauthorized for the action an agent chooses next. A correct login tells a service something about access to an account. It does not establish that a human approved changing a beneficiary, exporting a client database, or committing an organization to a contract.
NIST's October 27 design tenets distinguish agent identities from human identities, call for signed mandates and bounded delegation, and recommend separating policy enforcement from probabilistic reasoning. NIST also proposes deterministic authorization decisions and independent, tamper-evident evidence. These are proposed design tenets from a NIST blog and related NCCoE work, not a binding regulation or completed interoperability standard.
For a business owner, the distinction is immediate. An agent may need permission to read invoices and assemble a forecast. It does not follow that the same agent should be able to approve invoices, modify its own authorizations, or initiate disbursements.
MoonVault view: intelligence may recommend the action; a separate control plane should decide whether the action is permitted.
Credential custody moves outside the reasoning loop
1Password's October 22 announcement describes an approval-mediated agent sign-in: the agent requests access, the user authorizes the request, and 1Password fills the credential into the destination without giving the password to the agent itself. Its announcement distinguishes integrations available immediately from others still coming. This is a vendor-described product design, not proof that every automated browser action is secure.
The revised Agent-to-Wallet Protocol for Digital Credentials (A2WP) offers a related but different idea. In this individual draft, the agent forwards credential requests while a wallet holds credentials and keys, selects disclosure, seeks approval where appropriate, and performs the cryptographic transaction. The agent receives the outcome needed to resume its task. The draft explicitly discusses manipulated agents, untrusted counterparties, phishing, and continuation risks.
A2WP is not an adopted IETF standard. It is an individual proposal and a useful architectural experiment. Its value to the conversation is the security boundary it illustrates, not any claim of universal deployment.
Commercial identity infrastructure is entering production
IBM's October 26 general-availability announcement positions agents as distinct identities with ownership, registration, risk classification, scoped delegation and audit trails. Its architecture connects IBM Verify for identity and authorization with HashiCorp Vault for just-in-time credential access, including target-specific credentials for systems that cannot use delegated tokens directly.
This is meaningful because organizations already have identity providers, workforce policies, secrets managers and audit obligations. The new challenge is not inventing a login for every model. It is preserving the original principal's intent across chains of agents, tools, API calls and credential brokers.
IBM reports that its product addresses those needs; independently verified customer coverage, interoperability and operational performance must be assessed separately. The fact of a general-availability announcement does not mean the governance problem has been solved.
Where the system can still fail
- Approval fatigue: If every harmless step requires approval, people learn to click through warnings. High-risk actions need more context and more deliberate escalation, not simply more prompts.
- Hidden downstream authority: An agent might operate within its apparent scope while a connector or sub-agent inherits broader rights. The delegation chain has to constrain every handoff.
- Persistent sessions: Keeping the password hidden is helpful, but a browser session or token may still permit consequential actions after the original task has changed.
- Provider dependence: The owner needs a recovery path if an identity provider, credential manager or AI vendor becomes unavailable.
The MoonVault question is continuity
Credential custody, authentication and authorization are not interchangeable. The agent identifies itself; the principal delegates an outcome; the policy engine evaluates the requested operation; a credential service enables only the permitted access; and an independent record establishes what occurred.
MoonVault's longer-horizon thesis asks how that authority relationship survives changes in agent, device, vendor, organization or principal. Can a mandate be audited after the original assistant has disappeared? Can a successor understand which authorities remain active? Can rights be withdrawn everywhere without relying on a single product provider?
Those are open design questions, not claims about an operating MoonVault service. The important shift in October is that several actors are now addressing adjacent parts of the same problem. Building trustworthy autonomy may depend less on smarter agents than on making authority portable, limited, visible and recoverable.
Primary sources and evidence status
- NIST, Design Tenets for Agent Identity Management Systems, October 27, 2026 (proposed guidance).
- IBM, Agent Identity general-availability announcement, October 26, 2026 (vendor announcement).
- 1Password, Introducing 1Password for Agents, October 22, 2026 (vendor announcement; integration availability varies).
- Agent-to-Wallet Protocol, revision 01, October 17, 2026 (individual Internet-Draft, not an IETF standard).