An organization cannot review an agent’s authority if it cannot connect the agent to a responsible owner. It also cannot rely on a registry alone when the agent is already making consequential calls. Discovery, approval and enforcement have to meet in the working system.
RSA announced Agent ID on October 7, describing Discover, Secure and Govern modules. Discover and Secure are scheduled for general availability on November 16, 2026; Govern is scheduled for the first half of 2027. A fully air-gapped, self-managed version is also a future plan, not a current capability established by the release.
Approval needs an identity and an object
RSA describes a gateway applying policy on each call, with named operators approving high-risk actions using phishing-resistant credentials. The important design question is what precisely is approved: an individual operation, a bounded sequence or an open-ended goal. Those choices create different exposure if the agent changes its plan.
The release is evidence of the intended architecture and schedule. It is not an independent test of coverage across arbitrary tools. A deployment review should inspect unsupported paths and confirm that agents cannot bypass the gateway with a different credential or network route.
Evaluate before broad delegation
Teams can prepare now by inventorying agent owners and documenting sensitive actions. Product acceptance should wait for a supported configuration and a clear test of allowed, denied and revoked requests. A central log is useful only if it captures the actual actions taken in downstream systems.
If those controls hold under retries and changing permissions, organizations could delegate more narrow tasks while retaining an accountable human decision boundary. The next evidence should demonstrate the promised availability and the behavior of a real integration when approval is denied, expires or is withdrawn mid-task.
Sources & evidence
Sources describe the announcements and evidence available when this analysis was published. Company claims are attributed; plans and trials are not treated as sustained operation.
