# A Novel Zero-Trust Identity Framework for Agentic AI: Decentralized Authentication and Fine-Grained Access Control arXiv: https://arxiv.org/abs/2505.19301 ยท HTML: https://mlsanity.com/paper/2505.19301/ ## Key facts - Cited by 28 papers in the map (data through 14 Oct 2026). - Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. - Builds on 7 of its 45 references that are in the map. - First posted on arXiv 25 May 2025. ## Placed in - LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/) ## Builds on (most cited first, 7 of 7) - [A survey of agent interoperability protocols: Model Context Protocol (MCP), Agent Communication Protocol (ACP), Agent-to-Agent Protocol (A2A), and Agent Network Protocol (ANP)](https://mlsanity.com/paper/2505.02279/) (2025) - [Enterprise-Grade Security for the Model Context Protocol (MCP): Frameworks and Mitigation Strategies](https://mlsanity.com/paper/2504.08623/) (2025) - [Agent Name Service (ANS): A Universal Directory for Secure AI Agent Discovery and Interoperability](https://mlsanity.com/paper/2505.10609/) (2025) - [IDs for AI Systems](https://mlsanity.com/paper/2406.12137/) (2024) - [Securing GenAI Multi-Agent Systems Against Tool Squatting: A Zero Trust Registry-Based Approach](https://mlsanity.com/paper/2504.19951/) (2025) - [Building A Secure Agentic AI Application Leveraging A2A Protocol](https://mlsanity.com/paper/2504.16902/) (2025) - [A Comprehensive Formal Security Analysis of OAuth 2.0](https://mlsanity.com/paper/1601.01229/) (2016) ## Built on by (most cited first, 28 of 28) - [A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypes](https://mlsanity.com/paper/2601.05293/) (2026) - [AI Agents with Decentralized Identifiers and Verifiable Credentials](https://mlsanity.com/paper/2511.02841/) (2025) - [Distributional AGI Safety](https://mlsanity.com/paper/2512.16856/) (2025) - [From Multi-Agent Systems and the Semantic Web to Agentic AI: A Unified Narrative of the Web of Agents](https://mlsanity.com/paper/2507.10644/) (2025) - [AI Identity: Standards, Gaps, and Research Directions for AI Agents](https://mlsanity.com/paper/2604.23280/) (2026) - [Overlaying Governance: A Compositional Authorization Framework for Delegation and Scope in Agentic AI](https://mlsanity.com/paper/2606.03518/) (2026) - [COALESCE: Economic and Security Dynamics of Skill-Based Task Outsourcing Among Team of Autonomous LLM Agents](https://mlsanity.com/paper/2506.01900/) (2025) - [Agent Capability Negotiation and Binding Protocol (ACNBP)](https://mlsanity.com/paper/2506.13590/) (2025) - [AgentReputation: A Decentralized Agentic AI Reputation Framework](https://mlsanity.com/paper/2605.00073/) (2026) - [Fortifying the Agentic Web: A Unified Zero-Trust Architecture Against Logic-layer Threats](https://mlsanity.com/paper/2508.12259/) (2025) - [Architecting Trust in Artificial Epistemic Agents](https://mlsanity.com/paper/2603.02960/) (2026) - [Cross-Layer Semantic Flow Reconstruction for Attack Detection in Agentic Systems](https://mlsanity.com/paper/2603.04469/) (2026) - [Who Governs the Machine? A Machine Identity Governance Taxonomy (MIGT) for AI Systems Operating Across Enterprise and Geopolitical Boundaries](https://mlsanity.com/paper/2604.06148/) (2026) - [GRAIL: A Deep-Granularity Hybrid Resonance Framework for Real-Time Agent Discovery via SLM-Enhanced Indexing](https://mlsanity.com/paper/2605.02489/) (2026) - [The Internet of Agentic AI: Communication, Coordination, and Collective Intelligence at Scale](https://mlsanity.com/paper/2606.12835/) (2026) - [Access Controlled Website Interaction for Agentic AI with Delegated Critical Tasks](https://mlsanity.com/paper/2603.18197/) (2026) - [AIAuditTrack: A Framework for AI Security system](https://mlsanity.com/paper/2512.20649/) (2025) - [SS-ZKR: Spatial-Semantic Zero-Knowledge Routing for Privacy-Preserving Multi-Agent Collaboration](https://mlsanity.com/paper/2606.00962/) (2026) - [AONA: A Comprehensive Architecture and Workflow Design for Global Agentic Collaboration](https://mlsanity.com/paper/2606.20573/) (2026) - [Clarus: Coordinating Autonomous Research Agents toward Web-Scale Scientific Collaboration](https://mlsanity.com/paper/2606.30246/) (2026) - [Engineering Trustworthy Agentic AI for Critical Systems](https://mlsanity.com/paper/2607.18548/) (2026) - [Cryptographically verifiable authorization for autonomous AI agents: a falsifiable hypothesis and proof of concept](https://mlsanity.com/paper/2607.21325/) (2026) - [InterSAGE: The Secure and Verifiable Interoperability Protocol for An Internet of Agents](https://mlsanity.com/paper/2608.13030/) (2026) - [A Policy Algebra for Trust-Preserving Agentic AI Execution](https://mlsanity.com/paper/2608.16402/) (2026) - [NostrAgent: A Decentralized Identity and Delegation Architecture for Sovereign Agentic Systems](https://mlsanity.com/paper/2609.22944/) (2026) - [When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systems](https://mlsanity.com/paper/2609.23700/) (2026) - [AgentKernel: The Trust-Native Agentic Operating System](https://mlsanity.com/paper/2609.29647/) (2026) - [Who is the 'I' in AI? Establishing Decentralized Identity and Accountability for Autonomous Agents](https://mlsanity.com/paper/2610.17126/) (2026) ## Abstract (arXiv) Traditional Identity and Access Management (IAM) systems, primarily designed for human users or static machine identities via protocols such as OAuth, OpenID Connect (OIDC), and SAML, prove fundamentally inadequate for the dynamic, interdependent, and often ephemeral nature of AI agents operating at scale within Multi Agent Systems (MAS), a computational system composed of multiple interacting intelligent agents that work collectively. This paper posits the imperative for a novel Agentic AI IAM framework: We deconstruct the limitations of existing protocols when applied to MAS, illustrating with concrete examples why their coarse-grained controls, single-entity focus, and lack of context-awareness falter. We then propose a comprehensive framework built upon rich, verifiable Agent Identities (IDs), leveraging Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs), that encapsulate an agents capabilities, provenance, behavioral scope, and security posture. Our framework includes an Agent Naming Service (ANS) for secure and capability-aware discovery, dynamic fine-grained access control mechanisms, and critically, a unified global session management and policy enforcement layer for real-time control and consistent revocation across heterogeneous agent communication protocols. We also explore how Zero-Knowledge Proofs (ZKPs) enable privacy-preserving attribute disclosure and verifiable policy compliance. We outline the architecture, operational lifecycle, innovative contributions, and security considerations of this new IAM paradigm, aiming to establish the foundational trust, accountability, and security necessary for the burgeoning field of agentic AI and the complex ecosystems they will inhabit.