Agent Authority Audit: What 9 Enterprise AI Platforms Actually Prove in 2026 · Enterprise Agentic AI Insights

Agent inventory is solved. Agent authority is not. A verified side-by-side of per-agent credentials, per-step authorization, delegation records and revocation across ServiceNow, Microsoft, Google, AWS, Salesforce, Snowflake, NVIDIA, Anthropic and OpenAI.

On October 15, ServiceNow put a name on the thing most agent governance programs have been quietly missing. It called the thing AI Passport, and it described it in a sentence worth reading twice: a cryptographically signed credential that agents reference at runtime to verify their authorized scope, with "precision revocation and scoped delegation that narrows at each step."

Jon Sigler, executive vice president and general manager of ServiceNow's AI Platform, framed the problem as plainly as a vendor ever does. Visibility alone is not enough.

He is right, and the reason he is right is the reason this edition is a measurement rather than a commentary. Over the past eighteen months the enterprise AI platform market solved agent inventory. Microsoft shipped Agent 365 and Entra Agent ID in May. AWS took its Agent Registry to general availability in August. Google's Agent Registry catalogs approved agents, MCP servers, tools and endpoints. ServiceNow says the Control Tower will include 400+ out-of-the-box connectors for AI discovery. A CIO who could not answer "how many agents do we run" in January can usually answer it now.

The Chief Risk Officer is asking a different question, and that question is still open.

The mechanic that is failing

There is a difference between an action log and an authority record, and almost every platform in the enterprise stack ships the first while implying the second.

An action log says: agent svc-claims-triage-07 read 1,412 rows from the claims table at 14:06 UTC. Useful. Necessary. Not sufficient.

An authority record says: at 14:06 UTC, agent svc-claims-triage-07 was operating under a credential issued at 13:58, scoped to read-only on the claims table, delegated from a parent orchestration agent that had itself been scoped down from a human adjuster's session, carrying an authority that expired at 14:12, revocable in one place, with the whole chain signed.

The first tells you what happened. The second tells you whether it was allowed to happen, and lets you prove it to somebody who was not in the room.

Here is what the market actually ships against that second standard, verified at vendor primary sources this week.

Only one platform ships an ordered multi-hop delegation record. Snowflake's ACCESS_HISTORY.agents_info returns an ordered array of agent details for each object access, running from the nearest agent to the top-level agent, each entry carrying agentType, agentId and agentName. Snowflake's own documentation describes the purpose as reconstructing "the causal chain that compliance teams often need." That is the only shipping chain in the survey. One limit worth knowing before you rely on it: agentId and agentName are null for EXTERNAL_AGENT unless the agent arrived through OAuth token exchange, and the column is null entirely when no agent is involved.

Everyone else logs one or two levels. Google's Cloud Audit Logs show both the agent's identity and the user's identity when an agent acts on a user's behalf, which is two levels, not a chain. Microsoft's audit logs carry blueprintId, correlating an agent instance back to the template it came from, which is lineage, not delegation. Salesforce's Einstein Trust Layer Audit Trail captures the original prompt, the masked prompt and the feedback, held in the customer's Data 360 instance under their own retention setting and additionally retained by Salesforce for 30 days, with Salesforce's own guidance noting it "does not change what the agent user can query in the first place."

Per-step authorization is marketed by exactly one vendor and ships in Q4. "Scoped delegation that narrows at each step" appears in ServiceNow's October 15 release and in no shipping documentation from Microsoft, Google, AWS, Salesforce or Snowflake. The nearest shipping analogues are real and worth knowing: Google binds tokens to a 24-hour X.509 certificate with mTLS and DPoP so that, in Google's words, "certificate-bound tokens cannot be replayed outside their trusted runtime environment." Snowflake can bind a Restricted Session Scope privilege ceiling to a delegated access token for a single agent task. AWS added lifecycle hooks in September that let a Lambda return a synchronous allow or deny at before_tool_call, which is per-step enforcement built from customer code rather than an issued credential.

And two of the nine have no comparable primitive at all. Anthropic's Claude Managed Agents, in public beta, gives scoped tool permissions and a real architectural boundary by running the agent loop on a separate server from the execution sandboxes. That is a security boundary, not an identity. OpenAI Frontier's product page claims "agent identities let you scope access to exactly what each task requires." There is no OpenAI technical documentation describing that identity object, its credential format, its scoping syntax, its revocation mechanism or its audit schema. Everything verifiable in OpenAI's enterprise release notes is workspace, user and connector RBAC.

Two documented gaps deserve to be read out loud in your next architecture review, because both come from the vendors themselves.

Microsoft: "if an agent accesses resources using an API key, it bypasses the Microsoft Entra ID authentication and token issuance pipeline entirely and Conditional Access policies won't apply to them." Every control you built on Conditional Access has a documented bypass, and the bypass is the single most common way a team wires up an integration in a hurry.

Google: deleting an agent does not remove the IAM bindings that reference its principal. They persist as inactive grants that have to be cleaned up by hand. Redeploy the agent and it gets a new resource ID, so a new principal, so none of the old bindings carry over and all of them stay behind.

Why none of this is portable

The honest answer to "which standard should we build against" is that there is not one yet.

As of today there is no RFC specific to AI-agent identity or agent delegation. Token exchange and delegation RFCs exist in the general case, RFC 8693 among them, but nothing standardizes what an agent is authorized to do. The two most load-bearing documents aimed at the gap, the OAuth working group's ID-JAG draft and the WIMSE working group's AIMS draft, are both still working-group drafts. The IETF chartered a working group for agent communication protocols on October 8. It has no adopted working-group documents, its first milestone is December 2026, and its protocol does not reach the IESG until March 2028. Its charter explicitly puts "audit data structures and their production, validation, or consumption" out of scope.

The only stable artifact anybody can build against right now is the MCP Enterprise-Managed Authorization extension, promoted to a stable official extension in the July 28, 2026 spec revision, which makes the enterprise identity provider the authoritative decision-maker and delivers centralized revocation that takes effect immediately across all MCP clients. It is a protocol extension, not a standards-body standard, and it is genuinely the most useful thing on this list.

Which brings us to the sentence in the ServiceNow release that should be bookmarked by anyone evaluating AI Passport: it is "built on open specifications so that any governance product, identity provider, or enforcement point can issue and verify credentials." The release names no specification. No ServiceNow primary source names one. That is a question for the vendor call, not an assumption for the architecture diagram.

The part that makes it a board matter

Now the regulation, and only now, because the problem above is real whether or not a single line of it applies to you.

EU AI Act Article 26 sets out what a deployer owes, and two paragraphs land directly on the authority record. Paragraph 2 requires human oversight by natural persons with the competence, training and authority to exercise it. Paragraph 6 requires logs, to the extent they are under the deployer's control, retained for at least six months, unless Union or national law provides otherwise.

Read paragraph 2 against what the platforms actually produce. Authority is a property of a named human. When that human's authority is carried into an automated workflow by an agent, and then by a second agent the first one called, the delegation chain is the evidence that the authority the agent exercised is the authority the human actually held. If your audit record stops at "an agent did this," you have evidenced the action and not the oversight. Six months of action logs is six months of the wrong artifact.

Two dates sharpen this.

October 19, 2026. The Commission published the first harmonised standard supporting the AI Act in the Official Journal, EN 18286:2026, on quality management systems for AI Act regulatory purposes, cited through Commission Implementing Decision (EU) 2026/2274. Providers implementing it get a presumption of conformity with the Article 17 requirements the standard covers. It is designed to layer on top of ISO/IEC 42001, ISO 9001 or a sectoral system such as ISO 13485 rather than replace them. This is the first time process evidence in this regime converts into a legal presumption, and it is worth noting precisely what it covers, which is Article 17 and not Article 26.

December 2, 2026. Forty-two days out. Confirmed in the operative text of Regulation (EU) 2026/1744, which inserts a new Article 111(4): providers of AI systems, including general-purpose systems, generating synthetic audio, image, video or text, placed on the market before August 2, 2026, must comply with Article 50(2) by that date. The same date brings the new prohibition on non-consensual intimate imagery and CSAM into application. This one binds providers rather than deployers, and plenty of enterprises have quietly become providers of a system by the Act's definition without putting it that way internally.

For financial services the frame is DORA. On October 13 the Joint Committee of the EBA, EIOPA and ESMA published its 2027 work programme, committing to continued oversight of critical ICT third-party providers and to assessing the implications of technological developments "including the growing use of artificial intelligence." Note what ServiceNow shipped on October 15 and made available immediately rather than in Q4: Operational Resilience for financial services. That is not a coincidence, it is a vendor reading the same work programme you should be reading.

One thing worth saying plainly, because the opposite keeps circulating. No EU AI Act fine has been imposed on anyone. The Commission's enforcement page, updated October 20, describes investigative powers and penalty ceilings and names no party. A Commission midday briefing has described requests for information as the first enforcement steps. Those requests are not fines. Build for the obligation, not for a rumor of a penalty.

In the United States the near-term item is Colorado. SB 24-205 never took effect; it was repealed and replaced by SB 26-189, effective January 1, 2027, which gives consumers the right to request meaningful human review of a covered automated decision to the extent commercially reasonable. The rulemaking hearing is October 26, 2026, five days from now, and the Department of Law has declined a formal enforcement grace period. A human review right is an authority question wearing a consumer-protection hat. Answering it at scale means knowing which decisions an agent made alone.

The move

Four steps, and the order matters more than the speed.

One. Separate your action log from your authority record, on paper, this week. Take ten agent actions from last month at random, preferably ones that touched a customer, an applicant, a patient or a claimant. For each, try to produce: the credential it operated under, the scope of that credential, who or what delegated it, when it expired, and who could have revoked it mid-action. The ten you cannot complete are your actual exposure. This takes an afternoon and it is the single most clarifying exercise available right now.

Two. Find your API key bypasses before an auditor does. Microsoft has documented that an agent reaching a resource with an API key skips the Entra pipeline and Conditional Access entirely. The equivalent exists on every platform under a different name. Inventory where agents hold static credentials rather than brokered ones, and treat each as a control you do not have rather than a control you have not tested.

Three. Put the delegation chain in the contract, not the roadmap. For every agent platform up for renewal in the next two quarters, ask four questions in writing. Can you produce an ordered record of which agent delegated authority to which, for a given action. Can authority be narrowed at each step rather than inherited whole. Can a single revocation take effect everywhere immediately. Which named open specification is the credential built on. The fourth question is the one that separates a roadmap from a product, and right now almost nobody passes it.

Four. Set the default to narrowest, because inheritance is the quiet failure. Snowflake's own caveat is the general case: agents cannot exceed the user, but by default they inherit the user's whole footprint unless a Restricted Session Scope is applied. An agent that inherits a senior analyst's access and then calls two more agents has distributed that analyst's authority across a surface nobody drew. Narrow at provisioning, not after the incident.

The inventory question is close to solved. The authority question is a year behind it, the standards body that would settle it reports a protocol in 2028, and the first product that answers it properly ships sometime in the next ten weeks.

That gap is the work. It is also, for the next few quarters, a genuine difference between organizations that can answer a regulator and organizations that can only answer a dashboard.

---

AEGIS, the Agentic Enterprise Governance and Intelligence Standard, treats the authority record as a first-class artifact rather than a byproduct of logging. The Agent Authority Gap Calculator below is the working instrument from AEGIS Diagnostic engagements.

<div data-ariana-embed="agent-authority-gap-calculator"><p><a href="/assets/tools/agent-authority-gap-calculator.html" target="_blank" rel="noopener">Open the Agent Authority Gap Calculator →</a></p></div>

---

Sources

ServiceNow Newsroom, "ServiceNow advances its operational harness for enterprise AI with AI Passport and expanded governance capabilities," October 15, 2026. https://newsroom.servicenow.com/press-releases/details/2026/ServiceNow-advances-its-operational-harness-for-enterprise-AI-with-AI-Passport-and-expanded-governance-capabilities/default.aspx
NVIDIA Newsroom, "NVIDIA Open Agent Safety Platform," September 28, 2026. https://nvidianews.nvidia.com/news/open-agent-safety-platform
Microsoft Learn, "Conditional Access for agent identities," updated September 30, 2026. https://learn.microsoft.com/en-us/entra/identity/conditional-access/agent-id
Microsoft Learn, "Sign-in and audit logs for agents." https://learn.microsoft.com/en-us/entra/agent-id/sign-in-audit-logs-agents
Google Cloud, "Agent Identity overview," updated October 16, 2026. https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/agent-identity-overview
Google Cloud, "Agent Gateway overview," updated October 15, 2026. https://docs.cloud.google.com/gemini-enterprise-agent-platform/govern/gateways/agent-gateway-overview
AWS, "Amazon Bedrock AgentCore release notes." https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/release-notes.html
Salesforce Help, "Agent user," release 264.0.0. https://help.salesforce.com/s/articleView?id=ai.agent_user.htm
Snowflake Docs, "ACCESSHISTORY." https://docs.snowflake.com/sql-reference/account-usage/accesshistory
Snowflake Docs, "Restricted Session Scope." https://docs.snowflake.com/user-guide/restricted-session-scope
Anthropic, "Managed Agents overview." https://platform.claude.com/docs/en/managed-agents/overview
OpenAI, "Introducing OpenAI Frontier," February 5, 2026. https://openai.com/index/introducing-openai-frontier/
Model Context Protocol, "Enterprise-Managed Authorization," stable extension, spec revision July 28, 2026. https://modelcontextprotocol.io/extensions/auth/enterprise-managed-authorization
IETF, "Agent Communication Protocols (agentproto) WG," charter approved October 8, 2026. https://datatracker.ietf.org/wg/agentproto/about/
IETF, "Identity Assertion JWT Authorization Grant," draft-ietf-oauth-identity-assertion-authz-grant-04. https://datatracker.ietf.org/doc/draft-ietf-oauth-identity-assertion-authz-grant/
IETF, "AI Identity Management System," draft-ietf-wimse-aims-00, September 15, 2026. https://datatracker.ietf.org/doc/draft-ietf-wimse-aims/
European Commission, "First harmonised standard supporting the AI Act published in the Official Journal," announced October 19, 2026; Commission Implementing Decision (EU) 2026/2274 of 12 October 2026, OJ 14 October 2026. https://digital-strategy.ec.europa.eu/en/library/first-harmonised-standard-supporting-ai-act-published-official-journal
EUR-Lex, Commission Implementing Decision (EU) 2026/2274. https://eur-lex.europa.eu/eli/dec_impl/2026/2274/oj/eng
EUR-Lex, Regulation (EU) 2026/1744, Digital Omnibus on AI. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601744
European Commission, "Enforcement of the AI Act," updated October 20, 2026. https://digital-strategy.ec.europa.eu/en/policies/enforcement-ai-act
EIOPA, "European Supervisory Authorities set priorities for 2027," October 13, 2026. https://www.eiopa.europa.eu/european-supervisory-authorities-set-priorities-2027-2026-10-13_en
Colorado Department of Law, ADMT and Chatbot Act rulemaking interim draft redline, October 6, 2026. https://coag.gov/app/uploads/2026/10/2026.10.06-ADMT-Chatbot-Act-Rulemaking-Interim-Draft-Redline.pdf
Finnegan, "Colorado replaces landmark AI Act: an overview of the new SB 26-189 framework." https://www.finnegan.com/en/insights/articles/colorado-replaces-landmark-ai-act-an-overview-of-the-new-sb-26-189-framework.html

Ariana Digital LLC is an Anthropic Claude Partner. This article is analysis for planning purposes. It is not legal advice and not a compliance determination.

Open the formatted article on Ariana.Digital →