This past June, the Model Context Protocol (MCP) team stabilized Enterprise-Managed Authorization, and Anthropic pushed it live across Claude, Claude Code, and Cowork that same day. It’s a good release, but nearly every write-up has told the same narrow version of the story. It goes like this: a person signs into Claude, their connectors just appear, and there are no consent screens to click through. Zero-touch OAuth for humans.
While true, it’s the least impactful part of what shipped.
On the Surface
EMA works by making an organization’s identity provider the final word on MCP access. An admin turns a server on once, and users with the right group or role inherit it automatically. Under the hood, instead of redirecting through a per-server consent screen, the client requests an Identity Assertion JWT Authorization Grant, an ID-JAG, from the IdP when necessary, then trades that grant for an access token at the MCP server.
The IdP checks the policy before issuing it and can narrow the scope on the way through. And since the whole exchange is cheap to repeat, tokens can live for minutes rather than months, with revocation occurring at the IdP. Okta built the underlying primitive on established IETF token-exchange standards and calls it Cross-App Access. Anthropic and VS Code are the first clients, and Asana, Atlassian, Canva, Figma, Linear, and Supabase are among the first servers.
What Story Not Told – Empowering The Autonomous Agent
What’s not receiving sufficient attention is this: the mechanism that makes zero-touch login possible for humans also makes it possible to give an autonomous agent its own real, governed identity, one that isn’t a person’s identity at all.
Two new elements are driving this.
First, the interactive consent screen is gone, and with it the biggest obstacle to letting an agent keep working unattended. Agents can now access a new MCP server mid-task, within the policy the IdP has already approved, without waiting for a human to click “allow.” This means autonomy is bounded by policy, not by consent.
Second, and more importantly, nothing in the token format requires the subject of that grant to be a person. Today’s implementations still put a human in that slot and treat the agent as merely the client asking on its behalf, but the same machinery allows an IdP to mint a grant whose subject is the agent itself.
The “Ah Ha” Not Heard Round the World
That’s the “ah ha” story hiding under the zero-touch headline. There are three ways to structure agent identity, and which one you pick matters. The first is what EMA does today with the agent acting as a client on behalf of a human subject. This option works for an assistant doing work while I’m at the keyboard. But the agent inherits my entire blast radius and disappears the moment there’s no human in the session.
The second, using RFC 8693’s “actor” claim, records both the entity that authorized an action and the agent that carried it out. This is an elegant middle ground the spec gestures at but hasn’t standardized yet.
The third treats the agent as its own subject, giving it its own principal, credentials, lifecycle, and audit trail. Microsoft already ships something like this inside a single tenant with Entra Agent ID’s autonomous mode; Palo Alto and CyberArk do the equivalent with Idira. What none of them do is carry that identity across trust domains, which is precisely the layer at which EMA and ID-JAG operate.
Empowering autonomy. Enabling governance.
Giving an agent its own subject identity isn’t free. It maps to its own seat and license at every resource server it touches. For a long-running or high-stakes agent, that cost buys something worth far more: real attribution, independent revocation, and an audit log that tells the truth about who acted. A shared API key stitched into an agent gives you autonomy without any governance. EMA’s plumbing, confidential-client credentials, sender-constrained tokens, scoped grants, fast revocation, and step-up checks for sensitive actions finally make both possible.
This is important as we see the growth of AI agents used across businesses today. This scaling isn’t hypothetical. Gartner forecasts that AI agents will outnumber human sellers 10:1 by 2028 and that the average Fortune 500 company will have more than 150,000 AI agents. Microsoft has flagged a roughly 300% jump in incidents tied to non-human identity abuse. And AI identities soar, one survey shows that fewer than one in five security teams said their current identity tooling could manage agent identities at all. The volume is already here. The governance mostly isn’t.
EMA deserves credit for moving MCP authorization from consent screens to a policy-driven identity layer. But the conversation needs to extend beyond what the first release does to the protocol’s true promise. The real destination is an identity platform that treats humans, agent-as-actor, and agent-as-its-own-subject as equally first-class, across trust domains, at machine speed. EMA is the on-ramp. The destination is agents that don’t need to borrow anyone’s identity to get their work done, because they finally have their own. That is the only true path to the required agentic governance that organizations so badly need. For a deeper technical review check out my blog How EMA Enables the Rise of the Synthetic Employee.
Join our LinkedIn group Information Security Community!
