The IETF draft that half the agent-identity market is quietly building on expires in 36 days. Nobody is panicking. Nobody should. That gap between the alarm and the reaction is the most informative signal in the entire story.
The draft in question is the identity assertion grant work โ ID-JAG, described in the accompanying cross-app access profile as XAA. Its authors are Aaron Parecki, Michael McGuinness, and Brian Campbell, all recognizable names in the OAuth working group. Its IESG status sits at a single line: I-D Exists. Last revision, -04, has not moved in a year. No working group last call is scheduled. No area director has been assigned.
That last detail matters more than the headline, and almost nobody writing about this has noticed it. Drafts routinely sit between revision -03 and -06 for twelve to eighteen months. It happens thousands of times a year across the IETF. What is diagnostically unusual is the absence of an assigned AD, because that tells you whether someone inside the process has taken ownership of shepherding the work. Nobody has. The countdown is administrative noise. The unassigned shepherd is the actual signal.
So the market is running on a draft that has no institutional sponsor, two implementations, and no published third-party interoperability test. That is the real state of agent identity infrastructure in October 2026. The standard is not late. The verification is missing entirely.
Here is what that means mechanically, because the mechanical answer is the only one that survives contact with a procurement cycle.
Classic cross-application access had exactly two shapes. A static API key, pre-shared, long-lived, unauditable to a human, catastrophic on leak. Or a three-legged OAuth flow with a consent screen โ which requires a human present at the moment of authorization. An autonomous agent has no consent-screen moment. It has a task and a deadline. When an agent needs to read mail, edit a calendar, fire a notification, and update a CRM record, it crosses four trust boundaries. If every boundary requires a human nod, the agent's entire value proposition collapses into a notification service for tired people.
ID-JAG takes a third path, and the path is correct. It reuses the SSO trust the identity provider already holds, mints a short-lived, scoped, auditable JWT in real time, and exchanges it for a downstream access token. No static secret. No human in the loop. The audit trail anchors back to a real human identity. Every primitive involved โ RFC 8693 token exchange, RFC 7523 JWT authorization grants, IdP brokering โ has been in production for a decade or more. There is no unsolved cryptography here. There is no theoretical gap.
That is precisely why it will move slowly, and the reason is structural rather than political. A profile specification can only be proven correct through multi-vendor deployment. The IETF does not deploy. Vendors do. A profile that composes three stable RFCs into one scenario cannot be validated in a working group meeting. It gets validated when two implementations from different codebases exchange tokens and the tokens work. That validation has not been published.
Which brings us to the part of the story that the countdown framing actively obscures. Okta shipped this to general availability in August 2026. Descope launched on its own rail on October 15. Over twenty-five partners appear on the list, including Anthropic, Cloudflare, Keycloak, and WorkOS. Twenty thousand Okta customers exist as an addressable pool.
Now count what is actually missing from that paragraph. Of those twenty thousand customers, how many have enabled cross-app access in production? Of twenty-five partners, how many issue ID-JAG tokens against real traffic? Since the MCP extension stabilized in June 2026, what is the daily token exchange volume? Descope has been live two days โ is there a single named customer?
Shipped is not adopted. The entire "commerce is defining the standard" narrative rests on the word shipped standing in for the word adopted, and nobody has produced the number that would distinguish them.
I have audited enough of these claims at close range to recognize the failure mode. The presence of a partner logo is a decision to explore. The presence of production traffic is a decision to depend. Those are separated by a procurement committee, a security review, and a twelve-month renewal cycle. The gap between them is where protocols die quietly.
Now the asymmetry that the coverage has flattened. Okta and Descope are not making the same bet, and their risk profiles are not comparable.
Okta's exposure is close to zero. The draft's primary author is an Okta employee. He also chairs the OAuth working group. If the specification moves in an inconvenient direction during a last call โ and there will be a last call, one day โ Okta has the standing to file a correction, or to shim compatibility at the implementation layer. Meanwhile the strategic prize is enormous: if this becomes the default trust anchor for agent economics, the identity provider becomes structurally unskippable as agents multiply. An agent that must cross four systems must route through a broker. That is a moat built from protocol work its own employees wrote.
Descope's exposure is the opposite. It holds no drafting authority. It is pure follower positioning, timed eleven days before the draft lapses, which is a market-signal gesture rather than a product-maturity gesture. And behind Descope sit the twenty-plus partners who integrated against a specification they do not control. The rearchitecting risk does not distribute evenly. It concentrates at the bottom of the stack, which is exactly where the least capitalized players stand.
There is a second structural fact nobody is discussing, and it is the one I would raise first in any diligence call. The standards process here is being steered by a person whose three roles overlap precisely where conflict is most expensive: working group chair, deciding when last call gets scheduled; primary author, deciding what the draft says; and employee of the vendor with the largest commercial stake in the outcome.
That overlap is not misconduct. It is common in standards work and frequently benign. But it has a mechanical consequence that the countdown narrative misses entirely. For a competing identity provider โ a hyperscaler, say, with its own agent directory ambitions โ joining a working group chaired by a rival's employee and accepting that employee's draft carries political cost. The rational move is not to fight the draft in the open. It is to route around it, ship a private implementation, and let market share define the facts.
That is the fragmentation that should worry anyone underwriting this category. Not the three working groups with overlapping mandates โ that is ordinary division of labor, and treating it as institutional failure misreads the process. The real threat is a private answer from a player large enough to make the open standard optional.
The regulatory layer is where I diverge hardest from the consensus read. Europe's AI Act and the DORA requirements for financial infrastructure both demand auditability of automated decisions and third-party access. Agent identity that anchors its audit trail to a human principal maps directly onto those obligations. Which means adoption may decouple from working group progress altogether. Regulation can advance a standard that a committee will not. If a compliance deadline forces enterprises to prove who authorized which agent to do what, the buying decision lands on whichever implementation can produce that evidence, and the RFC number becomes a footnote.
The corollary is uncomfortable for the identity vendors. The biggest beneficiary of a compliance-driven adoption curve is not the broker. It is the audit and forensics layer โ the systems that can prove, after the fact, that a specific agent acted under a specific grant at a specific timestamp. That layer barely exists as a category, appears on no partner list, and carries more durable demand than the token-exchange plumbing itself.
Then there is the question the article should have led with and never asked: how does this thing get revoked?
A short-lived token crossing four or five systems creates a propagation window. If an agent is hijacked mid-task โ prompt injection being the obvious vector โ how long until every downstream system that accepted a valid grant stops honoring it? Thirty seconds? Five minutes? Does the revocation signal even reach the fourth hop before the token expires naturally? And what about delegation depth? Agent A authorizes agent B, which authorizes agent C. Systems that were never designed for transitive autonomy are now accepting authority chains, and each hop is an opportunity for privilege to amplify. That is the confused deputy problem with a fresh coat of paint and a much larger blast radius.
I have watched teams spend three nights stress-testing slippage models against gas spikes because the mechanical failure mode was the only thing that mattered. The same discipline applies here. The countdown timer is not a failure mode. It is a scheduling artifact. The revocation window is a failure mode, and it has no countdown attached, which is presumably why it attracts so little attention.
And one more number that should be read as a warning rather than a demand signal. Thirteen percent of organizations report confidence in their own AI governance. That figure has no attribution, no sample size, no methodology, and should not anchor any conclusion. But take it at face value for a moment and notice the tension it creates with the deployment narrative. A market that is simultaneously buying agent identity infrastructure at scale and confessing near-total loss of governance confidence is not a healthy demand curve. It is an accumulation of undeclared risk โ deploy first, govern later, hope the audit trail is there when someone asks.
Watch the deployment numbers, not the draft status. Watch the revocation latency, not the countdown. Watch whether the downstream applications that must validate these tokens actually exist, because an identity provider signing grants that nothing accepts is a very expensive way to mint worthless paper.
Thirty-six days from now the draft will lapse, someone will refresh it, and the timer will reset. The machines will keep exchanging tokens either way.