Amazon recently blocked Muse, Meta’s AI shopping agent, from making purchases on its site. According to Amazon, Meta never requested access to its store, Muse doesn’t identify itself as an agent while browsing, and it appears to capture and store customer credentials, all without Amazon’s knowledge or consent.
Meta counters that credentials go into secure storage the model itself never reads. Amazon’s terms now require agents to identify themselves via a text snippet in HTTP requests; Muse doesn’t send one.
Strip away the corporate sparring and this is a familiar security problem wearing a new outfit: one organization’s autonomous software is acting inside another organization’s systems, and there’s no shared way to establish who, or what, is actually there.
We solved this for humans years ago. OIDC and SAML let you log into a partner’s application without that partner managing your password, because there’s an agreed protocol for asserting identity and federating trust across organizational boundaries. That protocol doesn’t yet exist, in any adopted form, for agents.
And the industry knows it. The OpenID Foundation published a whitepaper, Identity Management for Agentic AI, alongside concrete draft extensions like OIDC-A, which propose agent-specific claims and delegation chains on top of standard OpenID Connect.
The National Institute of Standards and Technology (NIST)’s National Cybersecurity Center of Excellence put out a concept paper on agent identity and authorization. In addition, OWASP’s Agentic Applications Top 10 names Identity & Privilege Abuse as a top-line risk category.
AI Agent Identity Control Adoption is Lagging
What’s missing isn’t awareness. It’s adoption, and a working reference for what “solved” actually looks like operationally before a formal standard settles. Amazon and Meta are litigating this through terms-of-service enforcement and popup warnings because nobody has agreed on the protocol yet, and enforcement is what you fall back to in the absence of one.
Requiring a static text snippet in an HTTP header is the equivalent of asking someone to state their name at an unmonitored door – it lacks non-repudiation, tamper resistance and contextual authorization.
Whatever the eventual standard looks like, the operational pattern is already visible to anyone securing agents today. AI coding agents running in developer IDEs and calling internal tools on a developer’s behalf are a single-organization version of the same problem.
The controls that work there preview what a cross-org standard will eventually have to formalize. The lesson is already clear: an agent that borrows a human’s credentials is invisible, and an agent that polices itself is unaccountable.
How to Create Viable AI Agent Controls
Four architectural boundaries are critical to making agent interactions viable:
The Agent Gets its Own Identity
The default failure mode is an agent inheriting whatever access its logged-in user has, so nothing distinguishes “the human did this” from “the agent decided to”. Muse browsing Amazon indistinguishably from a person is this exact failure, just crossing a company boundary instead of an internal department one.
An agent needs to be a registered non-human identity, linked to its human principal via a cryptographic delegation chain. When downstream systems receive a request, the delegation token must verify not just that a human authorized an operation, but which specific agent runtime was delegated the authority to execute it.
Scope Gets Enforced at a Boundary the Agent Doesn’t Control
You cannot rely on an agent to self-limit. A broker or gateway must check the agent’s registered entitlements against an explicit authorization policy before a call reaches the target system. This functions much like an API gateway validating scopes and rate limits today, extended to evaluate runtime state: “Is this specific agent identity permitted to initiate a checkout transaction for this particular customer right now?”
Amazon built an ad-hoc version of this reactively by fingerprinting and blocking Muse’s traffic patterns. That is an expensive, brittle substitute for a cooperative protocol implemented on both ends.
Some Actions Require a Human in the Loop by Design
Research, price comparison, and drafting are low-stakes actions that can run autonomously. Committing funds, approving shipping destinations, or changing account access credentials are not.
Pragmatic architectures establish these boundaries prior to deployment (the agent prepares and stages, the human signs and approves) rather than discovering where the boundary should have been after an autonomous model executes an irreversible action. Step-up authentication workflows must be triggered dynamically when an agent’s requested action crosses that threshold.
Every Action Remains Reviewable After the Fact
Immutable, append-only audit logging is not a compliance checkbox here; it is the only way to reconstruct causal chains when an actor was a non-deterministic model rather than a person.
When an incident spans across organizational boundaries where visibility into the agent’s internal reasoning is impossible, signed receipts and deterministic event logs are the sole mechanism for accountability.
A fair objection is that terms-of-service enforcement is good enough, and that formal standards will always trail real-world practice. Platforms are certainly entitled to set their own rules, and Amazon’s identification requirement is a pragmatic first step. But unilateral rules mean every agent developer must engineer a custom handshake for every platform they touch, and agents that fail to comply can only be handled through reactive blacklisting after the fact.
A shared protocol doesn’t eliminate platform enforcement – it makes structured cooperation cheaper and more reliable than evasion.
None of this requires a fundamental research breakthrough; the emerging draft standards already outline the foundational primitives. Engineering and security teams do not need to wait for a ratified industry standard to begin implementing sensible boundaries.
Registering agent identities, enforcing policy at an external gateway, establishing human approval checkpoints, and securing tamper-proof logs are decisions organizations can implement today. What is missing is broader operational experience with these controls in production, and the collective will to adopt shared federation patterns instead of each platform constructing proprietary fences.
Amazon and Meta’s dispute will likely settle through revised terms of service this time. The next dispute – and the dozens that follow – will not remain manageable through corporate negotiation once autonomous agents are transacting across systems daily.