Why OAuth is not enough for unattended agents

The author argues that standard OAuth and X.509 certificates are insufficient for securing unattended AI agents because they rely on long-lived user tokens, static client secrets, or shared container credentials. Instead, agents require dynamic workload identities such as SPIFFE SVIDs minted and dropped per session, combined with OAuth primitives strictly used for human-to-agent delegation and audience-bound token exchange. Open article →