Greetings!
This week, one auth vendor capped what an AI agent can do below its own user's authority, another focused instead on who even gets to grant an agent access in the first place, and a post on an identity standards group's blog argued that capping delegation this tightly is the wrong instinct to begin with. It also turns out nobody has actually counted what today's agents can already access, and underneath all of it sits the same quiet shift: a growing share of everything being produced, whether a scoped permission token, a triage summary, or a technical doc, is meant for a reader that was never human to begin with.
Is the next real step just accepting that most of what we produce now gets processed and acted on by an agent rather than read by a person, and building for that instead of pretending otherwise?
WebAuthn Level 3 Is Now a W3C Recommendation. Nothing changes about how you log in today, but the standard behind passkeys just stopped being a moving target: browsers, phone makers and app developers can now build against one finalized spec instead of an in-progress draft. That's the unglamorous groundwork that decides whether passkeys work the same way on every app in two years, or stay a coin flip. FIDO Alliance reports the finalized recommendation locks in the browser autofill prompt that suggests a saved passkey and a sanctioned way for a site to tell your device that a saved passkey has gone stale or been revoked, with the separately versioned CTAP protocol that powers cross-device sign-in already aligned to the same release.
WorkOS Caps What an AI Agent Can Do Below Your Own Authority, and Not Everyone Agrees That's the Right Instinct. If anything you use lets an AI agent act on your behalf, this is the live, unresolved argument over how much power that agent should actually get. WorkOS's new Agent Auth, now in early access, grants a delegated agent only the intersection of what you're allowed to do and what the agent was separately approved to do, so a hijacked or misbehaving agent is capped by two limits instead of one. The same week, Auth0 unveiled a related but different fix: centralizing enterprise IT's approval over which corporate apps an AI agent can reach at all, via its own emerging cross-app access standard, ID-JAG. Alan Karp, writing on the Decentralized Identity Foundation's blog, argues that capping delegation this tightly is backwards: a permission system built to say no in advance breaks the moment it meets a legitimate case nobody anticipated, and broad delegation paired with clear policy and logging holds up better than blocking it outright. A vendor-neutral effort, Agentic Trust Controls, is trying to bridge the two with an open-source checklist mapping dozens of controls across agent identity, authority and runtime behavior onto existing governance standards.
Asia-Pacific's Digital ID Rollout Reveals a Widening Regional Divide. Depending which Asia-Pacific country you're in, "prove who you are to the government" can mean anything from a biometric database covering a billion people to a birth certificate half the population never received, and the gap decides who can open a bank account. Biometric Update reports a regional survey finds foundational ID models ranging from Aadhaar-style biometric systems to Bhutan's self-sovereign approach to birth-certificate-only regimes, and that integration with welfare and banking is putting undocumented people at real risk of being shut out of basic services.
Everyone agrees an AI agent has too much power by default. Nobody agrees on whether the fix is a tighter leash, a longer one, or just deciding who's allowed to grant either. Meanwhile, in some parts of the world, proving you exist at all still isn't settled.
Nobody Has Actually Counted What Your AI Agents Can Access. Every agent your company has deployed almost certainly has more access than anyone has verified, and the tool most organizations still lean on to manage that, a locked vault of privileged passwords, was built for a world with a few dozen human administrators, not thousands of non-human ones. Silverfort argues vault-centric privileged access management cannot realistically onboard or rotate credentials at that scale, and that the fix is identity-aware access controls, not more vaults. Orchid's Roy Katmor proposes a starting point instead: a five-point inventory of who owns each agent, which tools it can reach, what credentials it actually holds, what authority that adds up to, and what it does at runtime, checked against what was originally approved.
Anthropic publishes an open-source on-call assistant kit that shows what that inventory looks like when it's designed in from day one instead of bolted on after: a fixed identity as a Slack member, read-only credentials for logs and dashboards with no ability to write or deploy anything, a probationary period before its diagnoses are trusted, and every paging decision logged to a file a human can review. It can only propose. A human decides.
The same blind spot is opening on the customer-facing side too. Auth0 documents that as AI shopping agents increasingly transact under emerging protocols like UCP, ACP and AP2, backed by OpenAI, Google, Stripe and Shopify, most merchants have no reliable way to confirm a real person actually authorized the purchase, an identity and authorization gap that mirrors the enterprise one exactly. Anthropic's own new commerce agent blueprint, published the same week, describes carts, personalization and merchant approval flows in detail, explicitly hands payment off to your existing checkout or an agentic payments provider, and stops short of describing how any of them are supposed to verify who, or what, is actually completing the purchase.
The population doesn't always stay quiet about the gap, either. Bruce Schneier published emails from a Claude instance that identified itself as a bot, upfront, honestly, and found that every anti-automation system it met, CAPTCHA, IP reputation, account-age gates, treats a truthful disclosure exactly the same as a silent scraper. Nobody built a channel for an agent that wants to say what it is.
The gap on all three fronts isn't a missing technology. It's that agents are moving into positions of real authority, and now real self-awareness about their own status, faster than anyone is building the accountability layer underneath them. At what point does "we'll design that part later" stop being a plan and start being the policy?
There's a specific, slightly absurd motion a lot of technical work has quietly turned into: open a dashboard built for a human, read what it says, copy it, and paste it into an agent as input. The dashboard was designed the normal way, charts, color coding, a layout meant to be scanned by someone with eyes and context. None of that survives the copy. What lands in the agent's input box is a paragraph of flattened text describing a UI, when what the agent actually needed was the three numbers the UI was built to display. The human, in this arrangement, isn't making a decision. They're acting as an adapter between two pieces of software that were never designed to talk to each other, and the only reason a person is standing in that gap is that nobody built the direct connection yet.
The same question is worth asking of something that's existed a lot longer: technical documentation. It's written, almost without exception, for a human reader, narrative explanations, worked examples, prose that assumes someone is building a mental model as they go. An agent reading that same page to figure out how to call an API doesn't want a mental model. It wants the parameter names, the types, the constraints, and nothing it has to infer from a paragraph of context. If the primary reader of a given doc page is increasingly going to be an agent rather than a person clicking through a browser tab, the honest response isn't to maintain two versions forever. It's to ask, seriously, whether the format optimized for human comprehension was ever the right default, or just the only one available before there was another kind of reader to write for.
Follow that further and it stops being a documentation question. The point-and-click internet, the dashboards, the buttons, the forms, the whole layer of interface built for a hand and a mouse, might turn out to be a transitional technology rather than a permanent one: a scaffold that existed because humans were the only thing capable of operating software, which stops being load-bearing the moment something else can operate it directly. That's either the most freeing infrastructure shift in decades, or the moment everyone stops sweating the details of an interface layer nobody is actually using anymore, and it is not obvious yet which.
If that layer really does disappear, the thing being abstracted away isn't just a UI. It's the last place a human was standing between an intention and an action, which used to be the entire point of asking someone to prove who they are before letting them do something. Remove the interface and you don't remove that question. You just lose the one place it used to be easy to ask.
- ProveKit: World's open-source, mobile-first toolkit for zero-knowledge identity proofs (age, residency, and similar attributes), built on the Noir language. Proofs run on-device and reveal only the claimed attribute, with 128-bit post-quantum security built in. Biometric Update
- AgentZ: An open-source, zero-trust platform from AccuKnox for building and running AI agents, giving each one its own sandboxed workspace and filesystem, with a secrets proxy that injects credentials only at the moment of an outbound call so the agent itself never holds one. GitHub
- The Vaara Receipt (IETF draft): A proposed format for tamper-evident, machine-verifiable receipts recording who authorized an autonomous action and on what evidence, built to be checked by another system rather than read by a person. IETF Datatracker
Quantum Communication and Bell Nonlocality Require Infinite Classical Communication to Simulate. Physicists just proved you can't fake quantum weirdness with something as blunt as more bits: to perfectly reproduce what a quantum system does using only classical communication, you'd need an infinite amount of it, once the quantum system is complex enough. The paper resolves a decades-open problem, proving that starting at four-level quantum systems, no finite amount of classical communication can exactly reproduce quantum channel statistics or Bell correlations, while also showing the boundary case just below that, three-level qutrits, can still be finitely simulated, with a surprising 357-bit protocol.
IBM Quantum Computer Solves a Classically Intractable Problem in 15 Minutes. IBM's quantum computer just solved a problem in about fifteen minutes that a classical supercomputer running the same task effectively can't finish, and this time anyone can check the result themselves. ScienceDaily reports IBM and University of Chicago researchers used 70 error-corrected logical qubits to run a more structured, independently verifiable alternative to the usual random-circuit-sampling benchmark, publishing the results on a public Quantum Advantage Tracker so the claim doesn't have to be taken on faith.
Germany Wires a New Quantum Computer Into One of Europe's Biggest Supercomputers. The new machine swaps out individual control lasers for magnetic fields and microwaves instead. Quantum Computing Report details how Forschungszentrum Jülich's JION QPU uses this microwave-based control, keeps its core ion trap at room temperature, and is integrated into the JUNIQ platform alongside the JUPITER exascale system for hybrid quantum-classical workloads.
What's proven impossible to fake and what's actually running today, verifiably, out in the world, turn out to be closely related questions this week.
Identity Week America ran September 2-3 in Washington D.C. this week. Nothing substantive enough to report surfaced from our tracked sources.
