I work at Proof, and we're working on x401 as a means for agentic authorization

https://x401.proof.com/spec/latest/#abstract

in a nutshell:

* a website that wants to authorize who you are (say, to book a flight or sign a waiver for go kart rental)

* the endpoint returns 401 and defines in a header what info it needs about you (over 18? you're actually John Doe? etc.)

on the proof side specifically, we're putting IAL2 verification in front of this https://pages.nist.gov/800-63-3-Implementation-Resources/63A...

pretty cool stuff, its early days but its a strong way to ensure there's a human authorizing sensitive actions an agent is taking on your behalf

Blog post with context: https://openid.net/new-whitepaper-tackles-ai-agent-identity-...

Sorry for the heavy edit of the title, the original "Identity Management for Agentic AI: The new frontier of authorization, authentication, and security for an AI agent world" is much too long.

Executive Summary (from the linked pdf)

The rapid rise of AI agents presents urgent challenges in authentication, authorization, and identity management. Current agent-centric protocols (like MCP) highlight the demand for clarified best practices in authentication and authorization. Looking ahead, ambitions for highly autonomous agents raise complex long-term questions regarding scalable access control, agent-centric identities, AI workload differentiation, and delegated authority. This whitepaper is for stakeholders at the intersection of AI agents and access management. It outlines the resources already available for securing today’s agents and presents a strategic agenda to address the foundational authentication, authorization, and identity problems pivotal for tomorrow’s widespread autonomous systems.

Is the OpenID Foundation connected to the Open Society group?