# Identity Standards Stop at the Moment an AI Agent Acts

_The Agent Control Standard named five AI agent identity gaps on September 6, 2026. Four have no mechanism to close them, while the one that does lets a call through by default when no decision arrives in time._

By Johannes Keienburg, CEO & Founder  
Published: 2026-09-09  
Source: https://www.cakewalk.security/blog/acs-agent-identity-gaps

---

## One Compromised Agent Holds Every Permission Anyone Granted It

A car rental website cannot suddenly start managing payroll, because there is no code in it that could. That is why the access an ordinary application needs can be settled before it runs. An AI agent cannot be settled that way. It chooses while it runs which tools to call and which data to pull, which puts the decision about what it may do after the point where anyone wrote a policy. The Agent Control Standard, an open specification for making agents observable and controllable at runtime, published the first two documents of its identity working group on September 6, 2026. They name five problems this creates. Only one has a proposed fix.

> Agent systems are introducing a new class of failures where every token is valid, every API call is authorized, and the outcome is still a security incident.

_Agent Control Standard, Identity for Agents Overview, September 6, 2026_

The five gaps the standard names are chain integrity, over-privilege, token theft resistance, last-mile enforcement and proof of intent. Over-privilege is the easiest to see. Agents inherit [service accounts](/glossary/service-account), long-lived [API keys](/glossary/api-key) and [OAuth](/glossary/oauth) scopes written for human applications, which leaves one compromised agent holding every permission anyone has granted it. The standard's answer to that is [no standing privilege](/glossary/zero-standing-permissions).

The working group also surveyed the standards in use. OAuth and its extensions cover how a credential is issued, bound to its holder and passed from one system to the next, as do the newer drafts written for agents. None of them covers what the agent does once it holds the credential. The overview calls itself a working document that proposes no normative requirements yet. Naming a gap is not closing it.

## If No Answer Comes Back in Time, the Action Goes Ahead by Default

The one gap with a proposed fix is [last-mile enforcement](/blog/governing-the-new-frontier-the-missing-layer-for-agent-access), the final check before an agent's action reaches a company's live systems. Under the Agent Control Standard's proposal, the agent asks a separate service whether the action is allowed and waits a limited time for the answer. If no answer arrives in that time, the default is to let the action go ahead and record it in the [audit log](/glossary/audit-trail).

The standard sets that default so that a slow, failing or unreachable service does not stop a company's live systems. For as long as that lasts, the check is skipped. Security engineers call that failing open.

> Fail-open trades enforcement for availability under disruption: an adversary who can disrupt the channel converts control into audit.

_ACS v0.1.0 Instrument Specification, section 6.4_

A company that cannot accept that trade can switch the default so that the action is blocked instead.

> When Cakewalk's Model Context Protocol Gateway cannot prove a call is allowed, it blocks the call and says whether that came from a policy or from an error. We would rather explain a blocked action than an allowed one nobody can account for. Every governed call runs for a named person, carries the least the task needs and is checked when it runs. One record holds what was allowed, denied or escalated, so that someone who was not there can check the answer.

_Comment from Gil Röder, CPO & Co-Founder_

Source: OWASP GenAI Security Project, Agent Control Standard [Identity for Agents Overview](https://github.com/GenAI-Security-Project/agent-control-standard/blob/main/docs/identity/overview.md) and [Related and Emerging Standards](https://github.com/GenAI-Security-Project/agent-control-standard/blob/main/docs/identity/standards.md), published September 6, 2026, and the [ACS v0.1.0 Instrument Specification](https://github.com/GenAI-Security-Project/agent-control-standard/blob/main/docs/spec/instrument/specification.md), section 6.4.