AI headlines for business this week (Sep 8, 2026)
Okta ships Agent SSO, Microsoft Entra Agent ID lands in Dataverse, runtime authorization moves to the MCP gateway, and human-in-the-loop approvals become a standard SDK pattern.
Mid-October and identity caught up to agents: vendors now treat digital labor like employees with SSO, scoped roles, and audit trails. The question shifted from "which model?" to "which principal is calling this API?"
The deep dive explains agent identities and least privilege for a mid-size operator: one identity per agent, one human owner, and permissions that match the job description.
1. Okta Agent SSO: agents as first-class directory identities
Okta announced Agent SSO (general availability Aug 2026), registering agents that support Cross App Access as first-class identities in Universal Directory. CSA survey data cited in coverage: non-human identities can outnumber humans 90:1 or more, yet 70% of organizations grant AI systems broader access than a human in the same role. Over-privileged AI shows a 76% incident rate vs 17% with least privilege.
Why it matters for business: stop issuing shared service accounts to copilots. If your IdP cannot list every agent principal, you cannot offboard them either.
2. Microsoft Entra Agent ID for Dataverse
Microsoft rolled Entra Agent ID into Dataverse agent users: each agent gets a dedicated enterprise identity, least-privilege security roles, separated duties from human users, and auditable actions inside Power Platform workflows. Admins onboard agents like integration accounts but with lifecycle governance tied to a business owner.
Why it matters for business: if you run Dynamics or Power Apps agents, "run as admin" is no longer an acceptable default. Assign a role that can only touch the tables that job needs.
Microsoft: Entra Agent ID for Dataverse
3. Runtime authorization at the MCP gateway
Kiteworks' 2026 forecast and vendor guides highlight a painful gap: 60% of organizations cannot terminate a misbehaving agent, and 63% struggle to enforce purpose limitations at execution time. The emerging pattern is an MCP gateway that evaluates each tool call against policy and routes high-risk actions to verified human approval (CIBA-style out-of-band sign-off) before execution proceeds.
Why it matters for business: registration in a catalog is step one. If you cannot block a tool call mid-flight, governance is still mostly paperwork.
1Kosmos: runtime authorization guide
4. Agent personas: job descriptions, not super-roles
Forbes Technology Council and enterprise architects converge on the same idea: treat each agent as a persona with a human sponsor, constrained tools, and continuous runtime monitoring. Identity alone is not enough. You need context-aware policy ("this agent may update CRM notes but not export more than N rows").
Why it matters for business: write the job description before you wire the tools. "Sales agent" is not a permission set.
Forbes: govern agents inside your enterprise
5. Human-in-the-loop approvals in agent SDKs
OpenAI and other SDKs now document standard interruption and resume flows: sensitive tool calls pause the run, surface pending approvals, and continue from serialized state after a human or policy engine decides. This replaces bespoke email approval hacks with a pattern developers can ship.
Why it matters for business: demand this in vendor RFPs for any agent that spends money, sends external email, or changes production data. Pause-and-resume should be a checkbox, not a custom project.
OpenAI: guardrails and human review
What I would do this week
- List every agent principal in your IdP or cloud directory.
- Assign one human owner per agent and document decommission steps.
- Pick one high-risk workflow and require approval before tool execution.
- Read the deep dive on agent identities before your next security review.
Next post is the long read on agent identities and least privilege. Want blog updates? Join the notify list.
Matt Potter · Swift Media