Agent authorization hardens at Money20/20 and Authenticate

Microsoft turns zero trust inward on its own agents

Microsoft's announcement extends Project Perception, the security bundle it introduced in July, to AI agents operating inside enterprises. The October 19 blog post describes discovery for 35 additional local agent types, Dynamic Agent Risk scoring, Dynamic Conditional Access for agents, and Guardian Agents that apply a security team's decisions at scale. The posture shift is the story: agents are now treated as insiders subject to zero-trust evaluation, not as trusted automation, which concedes that an enterprise's own agents can be compromised, overprivileged, or impersonated exactly like employees. That is the position agentic governance skeptics have argued since the spring, now adopted by the vendor whose Copilot deployments created much of the exposure.

Proof ships the protocol and the wallet

Proof's claim is the largest: production identity verification and signed transaction authorization for AI agents, delivered through its x401 open HTTP protocol, first published in June, plus a new digital identity wallet for agents and a production Model Context Protocol server the company says works with ChatGPT, Grok, Claude, and Meta's Muse. The capabilities plug into the x402 agentic payment protocol, with users authorizing agent transactions through native device biometrics, and Circle and Proof demonstrated agents verifying identity and paying in USDC at Money20/20. Proof's framing device, the Agent Evidentiary Gap, names the distance between what an agent can do and what it can prove it was authorized to do, and the company points to Amazon blocking Muse agents as the cost of leaving that gap open: platforms that cannot verify an agent's mandate default to refusing the agent.

What buyers should take from the week

Three readings for teams building agent programs now. First, the layers are separating cleanly: human-bound credentials at the bottom, policy engines in the middle, transaction protocols at the top, and no vendor credibly spans all three, so agent authentication architecture is an integration exercise, not a procurement line. Second, every serious design routes back to a verified human principal through device biometrics or hardware, which makes the quality of that enrollment the ceiling for the whole chain, the inheritance rule delegated proof schemes already obey. Third, the vendor claims here, first-to-production status included, are company statements, and the FinCEN position that banks may in certain circumstances accept verifiable credentials and signed certificates for customer verification makes the evidence question regulatory, not rhetorical: whichever stack wins, examiners will ask who authorized what, with what scope, provable how. The decision plane answer is to treat agent mandates as evidence to verify, score, and log like any other identity claim, because the week's real news is that authorization just became a product category.