[ CONNECT / AGENT_IDENTITY ]

What is AI agent identity (non-human identity)?

Every AI agent needs a verifiable identity distinct from the human or service account that deployed it. Centurian registers, attests, and signs that identity at the MCP layer so every action traces to a specific agent, not a shared API key.

Non-human identity, and the AI-specific problem inside it

Non-human identity (NHI) is the security category covering service accounts, API keys, bots, and now AI agents, any credential that isn’t a person authenticating. The NHI security tier has consolidated quickly: Astrix was acquired by Cisco, Oasis by Cyera. That consolidation is a signal that credential-layer security for non-human actors is now considered core infrastructure, not a niche.

Agent identity narrows the problem further. An AI agent doesn’t just need a credential, it needs a provable link between that credential, the human or team that owns it, and the purpose it was registered for. Without that link, an agent with valid access looks identical to a compromised one, and an audit trail can show an action happened without showing which of ten agents sharing a key actually took it.

The standards are converging, but nobody has won

A scan of roughly 2,000 live MCP servers found authentication missing entirely on a meaningful share, agents calling tools with no verifiable identity behind the call at all. At the same time, the standards landscape moved fast: IETF WIMSE, the W3C agent-identity Community Group, OpenID AuthZEN/AIIM, and NIST NCCoE all converged on delegation and identity primitives within roughly the same eight-month window in 2025-2026. None of them has become the de facto standard yet.

Centurian doesn’t wait for that convergence to resolve. Every agent registers via MCP, the canonical front door at mcp.centurian.ai, gets a short-lived rotating signing credential, and is re-attested on a fixed cadence. The registration and attestation model is built to interoperate as the emerging standards settle, which matters for compliance evidence that needs to hold up years after it was generated, and for the audit trail that depends on knowing exactly who acted.

FAQ

What is AI agent identity?

What is non-human identity (NHI)?

Non-human identity is the broader security category covering service accounts, API keys, bots, and AI agents, any credential that isn't a person logging in. The NHI security tier has consolidated fast (Astrix acquired by Cisco, Oasis acquired by Cyera), which signals that credential-layer security for non-human actors is now table stakes. Agent identity is the AI-specific subset: an agent needs not just a credential, but a provable link between that credential, the agent's owner, and its declared purpose.

Why is a shared API key not enough?

A scan of roughly 2,000 live MCP servers found authentication missing entirely on a meaningful share of them, agents calling tools with no verifiable identity behind the call. When multiple agents share one API key, an audit trail can show that an action happened but not which agent took it. That is unusable evidence in a regulatory review or a security incident.

Is there an industry standard for agent identity yet?

Not a single winner. IETF WIMSE, the W3C agent-identity Community Group, OpenID AuthZEN/AIIM, and NIST NCCoE all converged on delegation and identity primitives within roughly the same eight-month window, but none has become the standard. Centurian's registration and attestation flow is built to interoperate as these standards mature, anchored to MCP as the canonical protocol today.

What does attestation actually prove?

Attestation is a signed statement that a specific agent, with a specific owner and declared purpose, was active during a specific window. Centurian issues short-lived rotating credentials at registration and re-attests on a fixed cadence, so an expired or revoked agent cannot silently keep acting under an old identity.

Get early access →

First agent free, forever · No credit card