Hey there 👋 I went through Google’s Agent Identity GA notes this morning looking for the line that costs you real work, and it isn’t the SPIFFE certificates or the 24-hour rotation. It’s one sentence three-quarters of the way down: the old IAM Connectors API is not getting a GA. That’s the migration hiding under the launch, and it’s the part nobody screenshots. If I had to bet, identity is where the agent stack quietly standardizes over the next two quarters, the same way auth did for web apps a decade ago. This week three different groups each shipped a piece of the same answer to one question: who is your agent, and on whose authority is it allowed to act? Google, the MCP maintainers, and AWS each placed a different bet, and they line up better than any of them planned. Four items and a bottom line. The through-line is that identity is leaving the prompt and moving into the platform. Grades below.
The Big ThingGoogle Cloud takes Agent Identity to GAOn Aug 22, Google Cloud moved the Agent Identity auth manager and the Agent Identity APIs (agentidentity.googleapis.com) to general availability, closing a sequence that started back in April. The shape: every agent gets a SPIFFE identity backed by an X.509 certificate that rotates every 24 hours, and the tokens it holds are certificate-bound, so a token lifted off the runtime is dead weight anywhere else. The auth manager is the other half. It’s a managed credential broker for outbound auth to non-Google tools, three-legged OAuth, two-legged, plain API keys, so your agent stops stashing secrets in its own code to call Salesforce or a vendor API. Google runs the vault and the exchange; the agent asks for a scoped credential when it needs one. Here is the sentence that turns a press release into a project plan: the legacy IAM Connectors API will not reach GA. If you built on it, that’s real migration work with a real clock on it, not a free upgrade. Read the release note for the deprecation path before you plan the quarter. One caveat worth stating plainly, and it’s an analyst read, not Google’s framing: the direct ADK path puts live third-party tokens in the agent’s process memory, which is exactly the blast radius a prompt injection wants. The safer wiring is the Agent Gateway path, which keeps the secrets out of agent code entirely. That contrast is Arnav Sharma’s (arnav.au), and it’s the right lens to bring to the design review. Ship it? If you’re GCP-native, prototype one agent against one external tool this week, on the Gateway path, not direct token injection. Put the APIs behind VPC Service Controls on day one and write an Org Policy custom constraint before you wire the first provider. If you’re not on Google Cloud, read it anyway: it’s the clearest picture yet of where agent identity is heading everywhere else. Sources: Google Cloud IAM release notes (Aug 22, 2026), Agent Identity auth manager overview docs; direct-vs-Gateway trust-model read via Arnav Sharma (arnav.au, Aug 26, 2026).
Tour de Headlines🔐 MCP publishes a roadmap, and it’s mostly about identity. The Model Context Protocol maintainers posted a direction-setting roadmap on Aug 22. It’s not code, it’s five priority areas, and the heaviest one is agent identity and enterprise security: finalizing DPoP (RFC 9449), Workload Identity Federation, and RFC 8693 token exchange, with an explicit rule against token passthrough and a requirement to validate token audience. Second on the practical list is progressive tool discovery, so an MCP server exposes a small entry point instead of dumping a hundred tool definitions into your context window. Grade it as intent, not a ship, but note the July 28 spec work it builds on (stateless servers, cacheable tool lists, the Enterprise-Managed Auth extension) is already stable and usable. The move today: add short-lived credentials and audit hooks to your MCP tools now, so the identity migration is an increment instead of a rewrite. Sources: Model Context Protocol blog, roadmap post (Aug 22, 2026). 🌐 AWS gives AgentCore web search regions and filters. Smaller item, but it lands on the same governance nerve. AgentCore’s managed, server-side web-search tool has been GA since June (it pulls live, cited web knowledge without the request leaving your AWS account), and on Aug 19 it picked up two things that matter: domain and published-date filtering, and expansion beyond us-east-1 to eu-west-1 and ap-northeast-1. The region part is the data-residency thread in disguise. If your reason for using an in-account search tool was keeping user context in-boundary, EU and Asia-Pacific coverage is the difference between a compliance yes and a compliance no. The filters are the quieter win: scope an agent to trusted domains and a recency window instead of letting it cite whatever ranks. No benchmarks, it’s a first-party release note, and it’s a different feature from the AgentCore auth-propagation work we covered last week. If you already run AgentCore search, turn on domain allowlists this week. Sources: AWS Bedrock AgentCore web search updates (Aug 19, 2026); tool reached GA June 16, 2026.
One More Thing💳 Your agent has a credit card now. Quietly, on Aug 18, AWS took AgentCore Payments to GA: agents can discover and pay for paid APIs, MCP servers, and content on their own, with wallet integration through Coinbase and Stripe’s Privy, plus observability on what got spent. The genuinely fun part is that an autonomous agent buying the API call it needs mid-task is the kind of thing that sounded like a demo a year ago. The honest catch, because a delight without one is just hype: the guardrail here is the spend cap you set at the infrastructure layer, not the model’s judgment about whether it should buy the thing. An agent that can pay is an agent that can overpay. The cap is the seatbelt, so set it before you hand over the wallet. Sources: AWS what’s-new and AWS ML Blog, AgentCore Payments GA (Aug 18, 2026).
Sponsor Your agents get a verified identity. Do your reps? RapportScore measures how your reps communicate on real calls, then coaches the behavior that builds trust. Deterministic signals you can coach against, not vibes. See where your team stands. See your team’s score → |
The Bottom LineLine the three up and they’re one story. Google brokers the identity and binds it to a certificate that expires. The MCP maintainers are standardizing the handoff so the token an agent presents means something real to the tool receiving it. AWS keeps the retrieval, and now the payments, inside the account boundary. None of it is a smarter model. All of it is answering the same question every autonomous agent forces: who is this thing, and what is it allowed to do with money and data it can reach? Google’s own survey from July put 79% of tech leaders naming security and governance as the top blocker to scaling, and 83% saying they need infrastructure upgrades to run agents in production. Seven weeks later, the market is shipping the plumbing. Identity used to be a string you trusted in a system prompt. Now it’s a certificate that expires. Do the boring things this week: pick the Gateway path over direct token injection, set the spend cap before the agent has a wallet, and write the org policy before the first provider goes in. The teams that treat identity as infrastructure now are the ones who won’t be rewriting it under an incident later. More tomorrow,
— Ron |
