Engineering Manager - Okta Access Gateway

Okta XAA ecosystem scales to 25+ partners as AI gateways become the identity enforcement layer. Okta's Cross App Access protocol is scaling through 25+ early adopters, and the AI gateway is becoming the identity checkpoint where agent connections get evaluated against enterprise policy before reaching any tool. Blair Hayes Forkast mind | 2026-10-03 10:26 PM PDT TrueFoundry, an AI gateway vendor, announced on October 1 that it had integrated Okta's Cross App Access (XAA) protocol into its gateway. That makes the gateway itself the identity checkpoint: the place where an agent presents credentials before any downstream tool or MCP server sees the request. It is the latest signal that XAA, Okta's open protocol for governing agent-to-app connections, is scaling not just through partner count but through the infrastructure layer where it actually matters. Okta's XAA ecosystem now includes over 25 early adopters, and the company's XAA developer playground opened this month. The identity gap XAA was built to close is straightforward. Most agents running in production authenticate with static API keys. Those keys do not expire, they are rarely scoped to a particular task, and they produce almost no audit trail. IT teams end up with limited visibility into what an agent actually accessed and when. Okta research cited by TrueFoundry puts numbers on the consequence: 88 percent of organizations report confirmed or suspected AI agent security incidents, and 92 percent of those that experienced an AI-related breach lacked adequate access controls. XAA replaces the static key with a short-lived token scoped to the specific task an agent is carrying out. The token is issued in real time against the user's active Okta identity, it can be revoked at any point, and it is logged so access remains auditable after the fact. Agent connections are evaluated against the organization's central identity policy in the same way a human user's access would be. Built on the ID-JAG standard (Identity Assertion Authorization Grant), XAA is an open OAuth extension that has been incorporated into MCP as its official authorization extension. It is vendor-neutral by design. Agent SSO, which launched in August 2026, brought XAA into Okta's workforce plans at no additional cost for over 20,000 customers, treating agents as first-class identities in the same directory as human users. XAA OIN Submission reached GA in the 2026.09.0 monthly release; the protocol itself is in Early Access with GA targeted for FY27.

Oktane 2026 recap: Okta announces A unified IAM control plane, with agent governance and identity details remaining unclear. Oct 1 2026 At last week's Oktane conference in Las Vegas, Okta unveiled its ambitious vision for transforming the Okta platform into a control plane for AI agents and extending deeper into AI security. The strategy was reflected throughout the event's keynotes and product announcements, which focused heavily on agent identity, runtime authorization, agent-to-agent interactions, and ecosystem collaboration. In his opening keynote, Okta CEO Todd McKinnon emphasized that open standards and collaboration are necessary to scale AI, acknowledging that no single vendor can govern and secure the agent ecosystem alone. The announcement of the Blueprint Alliance, a coalition of vendors with expertise in a variety of areas, underscored this point. Blueprint Alliance is a multivendor, open identity and access management (IAM) for AI agents' architecture that has agent governance, identity management, authorization, and interoperability components. It intends to coordinate with other vendors on how to build interoperable identity infrastructures. There is also an opportunity for Okta/Auth0 to extend the Blueprint Alliance to customer IAM (CIAM), e-commerce, and loyalty programs in the future. It also highlights that the success of Okta's strategy ultimately depends on whether the security, and especially the IAM/identity security industry, converges around common standards for agent identity, trust propagation, authorization, and accountability. Okta is productizing its IAM-for-agent strategies and planning to unify all (human, nonhuman identity [NDI], and agentic) identity management into a single control plane. Okta sees agent authentication and session management being different from human authentication and session management. Dynamic AI agent authorization based on intent and context were center stage in announcements. Highlights: In collaboration with Anthropic and other vendors, Okta has been actively developing the Cross App Access extension and enterprise-managed access specifications, which are now part of the MCP authorization extensions (issued by Anthropic, based on OAuth 2.1 but not yet part of standards issued by a standards body). Keenly believing in open standards and protocols, Okta has been promoting industry collaboration and coopetition. At Oktane, Okta was also able to bring in panelists from reputable North American financial institutions to describe their IAM for AI agents journey. Challenges: SPIFFE has started to become the de facto standards for nonhuman identities. Okta still does not have a full SPIFFE agent identity implementation - such as Aembit or Teleport, for example - kand still have not disclosed any plans for any universal know-your-agent (KYA) standards or frameworks (Okta has support for SPIFFE-based authentication on the roadmap for Q4 2026). Given that the Auth0 (CIAM) and Okta (workforce IAM) stacks have different session management and AI agent management capabilities, not having a unified platform increases the vendor's product development costs. It also increases enterprises' costs of building a unified workforce and CIAM infrastructure with equal-strength and interoperable human and nonhuman identities. The vendor's strategy for using the existing fine-grained authorization solution for AI agents seems unclear. Lastly, Okta's pricing for IAM for AI agents is still unresolved; instead of monthly active user-based pricing (common with human IAM), it likely will be transaction-based. Opportunities: Okta may play an important role in developing foundations for intent discovery and authorization decision-making - areas where there are no mature standards today. Building vendor-agnostic reference architectures for human, nonhuman, and agentic AI identity management for clients is likely, and the Blueprint Alliance is a good first step in this direction. Okta is also venturing into the CIEM space with AWS admin identity analysis, complete with access request management. Verifying human-to-agent provider (using OAuth 2.0) and agent provider + agent-to-service provider trust will help overall agent adoption. Forrester clients interested in discussing IAM for AI agents: Please book an inquiry or guidance session with Forrester Research, Inc.. See andras cser at: Security & Risk Forum November 9-10, 2026, Washington DC Missed the journey mapping webinar? Watch the replay. A model does not have to be smarter than Forrester Research, Inc. to be a problem. It needs a goal that it is certain about, the resources to keep pursuing it, and no one watching. Two of those three exist already. Forrester Research, Inc. took one doom scenario apart to find out how worried enterprises should be. Don't let AI doomsday headlines dictate your strategy. Stay grounded in what's real, manage the risks you can control, and focus on the investments most likely to create new value.