MCP Agent Identity Roadmap: Only One of Four Specs Ready, and It Targets Humans

The Model Context Protocol roadmap, published on August 22, lists agent identity and enterprise security as priorities, outlining four components: DPoP, Workload Identity Federation, the ID-JAG grant, and standard token exchange. Of these, only one specification is currently stable — the enterprise-managed-authorization extension — but it authenticates human employees via browser-based IdP login, not autonomous agents. A draft client-credentials extension exists for machine-to-machine use, but it relies on pre-registered credentials stored where the agent can access them, a known security risk. The two proposals that would grant agents a native identity independent of human delegation remain open pull requests with no stable spec yet. Developers deploying agents in production this quarter must bridge the gap themselves at a different architectural layer, as the protocol's own identity infrastructure is still incomplete.