Okta is expanding its identity security controls for AI agents, adding new capabilities for agent discovery, access governance, runtime enforcement, and rapid response as enterprises deploy more autonomous AI across their environments.
The new capabilities build on Okta’s blueprint for the secure agentic enterprise, introduced in March 2026, and are designed to answer four increasingly important questions for IT and security teams: where AI agents are operating, what they can access, what they are doing, and how organizations can respond when something goes wrong.
Okta expands AI agent discovery
Okta for AI Agents will surface unmanaged agents running on employee devices before they become blind spots.
The organization already brings agents into Universal Directory as a single source of truth: known agents can be registered directly or imported from platforms like AWS Bedrock, Cloud Managed Agents, and Salesforce Agentforce.
New controls govern agent access and connections
The ‘What can they do?’ section of the blueprint emphasizes how agents connect to apps, MCP servers, and other agents. If those connections can’t be inspected or controlled, a breach becomes easy.
While Okta already governs every connection an agent makes through Resource Connections – controlling both what data it can access and how it gets there – Okta now extends how connections are governed to:
- Agent SSO – Brings cross-app access to all customers, swapping non-expiring keys for short-lived, identity-governed tokens that decrease user consent fatigue.
- Okta for AI Agents: Agent-to-Agent Connections – Sets the rules for which agents can call which other agents, what each agent can access, and captures every handoff in an auditable chain.
- Okta for AI Agents: Configuration Designer – Visually maps agent-to-resource connections so every handoff is governed, scoped, and auditable.
- Resource Access Certifications – Reviews agent connections over time to prevent standing and excessive permissions.
Why AI agent security matters to channel partners
For channel partners, frameworks like Okta’s could become increasingly important as customers move from experimenting with AI agents to deploying them across production environments. Agents that interact with applications, data, other agents, and infrastructure introduce another identity that organizations need to discover, authenticate, monitor, and govern.
That creates a potential role for MSPs, MSSPs, systems integrators, and identity-focused partners beyond simply helping customers deploy AI.
The security implications extend into ongoing managed services as well. Okta’s Agent Gateway is designed to sit between an agent and its tool calls, enforcing policy and logging interactions at runtime, while expanded kill-switch functionality can revoke tokens and terminate active sessions if an agent is compromised.
For partners already managing identity, SIEM, or security operations for customers, those controls could make AI agent governance an extension of existing identity and security practices rather than an entirely separate discipline.
Agent Gateway adds runtime enforcement
The ‘What are they doing?’ portion of the blueprint discusses how organizations running AI agents need to identify what those agents are doing, as a single bad prompt can leave the door open to exposure.
Okta already provides a durable audit trail by capturing every agent in System Log and streaming it directly to SIEMs.
However, Okta is now extending visibility directly into the execution path with real-time runtime enforcement.
Okta for AI Agents: Agent Gateway will sit in the execution path between agent and tool call, enforcing policy and logging every interaction at runtime.
Kill switch targets compromised AI agents
Lastly, the ‘How do I respond?’ section of the blueprint breaks down how even a well-managed agent can be compromised, which teams need to be able to remediate instantly.
Okta is now expanding kill switch capabilities to Okta’s Agent Gateway. This will deactivate agents at the gateway the moment something goes wrong, enabling teams to revoke every active token held by a compromised agent and shut down every session in flight.
Organizations will gain centralized governance over their agents, delivering end-to-end lifecycle management, runtime policy enforcement, and an instant kill switch to revoke access the moment something goes wrong.
Okta is giving organizations one identity foundation across the agents they run, so they can innovate quickly without losing control.
“Moving fast with AI agents should not mean sacrificing control,” said Ryan Barnes, Director of IT at MJS Packaging. “Okta for AI Agents gives us the governance to deploy across the enterprise, accelerating innovation while eliminating security blind spots.”