Claude Code, OpenAI Codex, and Gemini CLI have seen significant adoption in production environments, with Claude Code leading in developer adoption surveys and public case studies. Security teams blinked, and suddenly these agents were pushing commits and opening pull requests.
That second question is where most organizations stumble. A 2025 survey conducted by EMA in conjunction with Ory found that 79% of organizations lack written policies for governing AI agents, but have already deployed them into production. Nearly four in five companies are running agents they have not formally scoped.
The surface area is enormous. OpenAI reported more than 1.2 billion weekly active users at DevDay in September 2026, with more than 35 million people using ChatGPT Work and Codex each week. Every one of those sessions creates machine-readable identities that need governing.
That governance gap is no longer theoretical. The SpyCloud 2026 Identity Threat Report found that compromised non-human identities (NHIs) are now the most common route attackers take into the enterprise, cited as the primary entry point by 31% of organizations. That is nearly twice the rate of phishing and social engineering at 17%.
Okta’s 2026 Businesses at Work report adds more urgency. It found that 90% of organizations do not yet have a comprehensive strategy for governing autonomous AI agents, while 91% of enterprises surveyed are already using AI agents.
Put those numbers together and the pattern is clear. Adoption is racing ahead of identity controls, and there is a growing recognition that AI agents require identity management beyond traditional software models.
Security leaders are being asked to secure tools that most policies never anticipated, and they are doing it without a shared vocabulary for what an agent identity even is. Vendors are responding with new categories, new frameworks, and a lot of overlapping terminology. Before anyone can compare them, the foundation needs to be in place.
That is why the discipline of non-human identity lifecycle management matters. It treats service accounts, API keys, OAuth tokens, CI/CD secrets, and autonomous agents as identities that need enrollment, rotation, attestation, and decommissioning, just like any human account.
Without that frame, an AI coding agent is just another API key waiting to be leaked.
Methodology: How We Evaluated These Vendors
This list is based on publicly available documentation, independent survey data, community signals, and product capabilities specifically relevant to governing coding agents.
The 2025 EMA survey done in conjunction with Ory drew on 271 qualified responses out of 1,256 total responses from IT, security, and IAM professionals across five countries: the US, UK, Canada, France, and Germany. All respondents represented organizations with 500 or more employees.
That survey anchors several of the vendor assessments below. The five-point criteria is given below:
- Agent identity primitives: Does the vendor treat AI agents as first-class identities with unique, immutable identifiers, not just API keys attached to human user accounts?
- Delegation and trust chains: Can the platform model and enforce the full chain from human to agent to downstream tool, with ceilings on what an agent can do on behalf of a user?
- Point-of-execution enforcement: Does the vendor enforce policy where agents actually execute actions, or only at the authentication gateway?
- Deployability and scale: Can the solution handle the throughput demands of agentic workflows, such as thousands of short-lived credential requests per second, across self-managed and SaaS models?
- Audit and observability: Does the platform provide trace-level logging that ties every agent action back to a specific identity, permission set, and human delegator, not just coarse-grained API usage logs?
This list specifically evaluates vendors for governing coding agents such as Claude Code, OpenAI Codex, Gemini CLI, etc., in enterprise development environments where agents access source code, CI/CD pipelines, cloud infrastructure, and internal APIs.
Ory: The API-First IAM Platform Built for AI Agent Scale
Ory sits at the center of this conversation. Its infrastructure manages nearly 3.3 billion identities, and OpenAI adopted an Ory Enterprise License for Ory Hydra’s web-scale authorization to power the ChatGPT platform that scaled to over 1.2 billion weekly users. The Ory identity solutions and security platform treats coding agents as first-class identities from day one.
What makes Ory stand out for coding agents specifically is its API-first, composable architecture. Security teams can mix and match identity components, keep full control over the user experience, and deploy the same APIs either as self-managed on-prem or cloud solutions or as a fully managed SaaS platform through the Ory Network.
That flexibility matters when agent traffic spikes from hundreds to millions of credential requests in a single quarter.
- Native integration with the 3 leading coding agents among many others: Ory’s platform natively integrates with Anthropic Claude Agent SDK, Gemini CLI, OpenAI Codex, AWS API Gateway, and many others, giving security teams one identity fabric across the tools they need to govern.
- Ory Agent Security enforces policy at the point of execution: Rather than guarding only the front door, Ory Agent Security enforces authorization where agents actually run, with visibility and auditability for Ory-built and connected agents through trace-level log correlation and performance intelligence.
- Ory Talos replaces static API keys with dynamic credentials: Launched in June 2026, Ory Talos uses Macaroon-based delegation and token derivation to replace permanent, static API keys with dynamic, revocable, least-privilege credentials, according to Ory Launches ‘Ory Talos’.
- Built on architecture that powers OpenAI: Ory Talos runs on the same high-concurrency Go architecture as Ory Hydra, designed for the authentication throughput that large-scale agentic workflows demand.
Best for: Organizations that need web-scale identity infrastructure for AI coding agents, especially those already using or evaluating OpenAI Codex at enterprise scale. Security teams that want composable, API-first IAM with point-of-execution enforcement rather than gateway-only controls.
Less ideal if: Your organization requires a fully turnkey, UI-driven IAM suite with minimal engineering investment in integration. Ory’s headless, API-first design rewards teams with strong identity engineering capabilities.
OpenAI Engineering Manager Benjamin Billings put it plainly, as quoted in the OpenAI case study: “OpenAI wanted a partner that could help enable our vision for owning our identity processes, data, and success. We have a lot of partners, and Ory is one of our best.”
Ory’s track record and role in powering one of the world’s most demanding AI platforms, makes it the strongest option for organizations that need identity infrastructure capable of keeping pace with agentic scale.
Okta: Enterprise-Grade Agent Governance with Full Lifecycle Management
Okta has rapidly expanded its identity platform to treat AI agents as first-class citizens. The Okta for AI Agents suite now includes an agent registry, Cross-App Access (XAA), agent-specific Conditional Access, centralized auditing, and a Runtime Agent Gateway.
Okta for AI Agents – Core, which brings lifecycle governance to regulated environments, is now generally available for FedRAMP and HIPAA regulated environments, which matters for government agencies and healthcare teams that need coding agents governed inside the same secure boundary as human workforces.
- Agent-as-first-class-identity model: Okta registers, protects, and governs AI agents with the same tooling used for human identities: Conditional Access policies, lifecycle workflows, and centralized audit logs.
- Granular governance with a complexity trade-off: Reddit community members described Okta’s agent governance as “the real product” covering what scopes an agent can touch, what gets auto-approved, what needs escalation, and how to audit everything after the fact. Some also called it a “nightmare micromanager,” which reflects powerful but heavy controls.
- Explosive NHI growth under management: The same Okta Businesses at Work report found access requests per company increased 158% year over year and 1,140% over two years, and centrally managed non-human identities rose 650% year over year as organizations scaled NHI governance.
Best for: Large enterprises in regulated industries such as finance, healthcare, and government that already use Okta for workforce identity and want to extend that investment to AI coding agent governance within a unified platform.
Less ideal if: Your development teams chafe under heavy-handed governance. Okta’s granularity comes with complexity that smaller, engineering-driven organizations may find constraining.
Okta’s advantage is maturity and regulatory coverage. For organizations where compliance is non-negotiable and the identity platform is already Okta, extending it to AI agents feels natural. The operational overhead, however, is real and worth planning for.
Teleport: Cryptographic Identity and Zero Standing Privileges for AI Coding Agents
Teleport approaches AI agent identity from an infrastructure access angle. It treats agents as machine identities that need the same cryptographic controls as workloads and CI/CD pipelines.
In January 2026, Teleport launched a dedicated agentic AI identity framework, and a survey of more than 200 infrastructure leaders found 69% believe widespread AI adoption will require significant changes to identity management, according to Teleport unveils identity framework for agentic AI security.
- Ephemeral, SPIFFE-compatible credentials: Teleport Machine & Workload Identity issues short-lived X.509 certificates and JWTs to AI agents, CI/CD pipelines, and workloads using SPIFFE-compatible identities, eliminating static credentials and enforcing zero standing privileges.
- Unified identity model across humans, machines, and agents: Teleport treats all three as first-class identities with full audit trails, so security teams can trace every agent action back to a cryptographically verified identity.
- Strong enterprise satisfaction with trade-offs: Teleport holds a 4.8/5.0 rating from 1,359 reference ratings on FeaturedCustomers in 2026, but some DevOps practitioners have reported Helm chart complexity in non-standard environments.
Best for: Infrastructure and platform engineering teams that already value zero standing privileges and want to extend that model to AI coding agents accessing servers, databases, and Kubernetes clusters.
Less ideal if: Your primary use case is API-level authorization rather than infrastructure access. Teleport focuses on securing access to infrastructure, including MCP, but does not explicitly mention application-layer policy enforcement for MCP tool calls.
Teleport’s cryptographic identity model is a strong fit for organizations that want AI coding agents governed under the same zero-trust infrastructure access framework as their human engineers. It does require commitment to the SPIFFE and zero-standing-privileges paradigm, which some teams will find more opinionated than they want.
Microsoft (Entra Agent ID): Native Agent Identity in the Microsoft Ecosystem
Microsoft Entra Agent ID treats AI agents as first-class identities with their own immutable object IDs, enabling agent blueprints, Conditional Access policies, agent-specific risk detection, lifecycle workflows, and ownerless-agent notifications, all within the same Microsoft Entra tools used for human identities.
- Deep integration with Microsoft’s AI ecosystem: Entra Agent ID works with Microsoft Copilot Studio, Azure AI Foundry, and Security Copilot, making it the natural choice for organizations already standardized on Microsoft’s AI toolchain.
- Service-principal-style behavior with known risks: Security researchers note that Entra Agent ID objects behave similarly to service-principal-style identities, and many powerful API permissions can still be assigned. Consent-phishing scenarios remain relevant, and roles like Agent ID Administrator and AI Administrator should be treated as highly privileged.
- Governance tooling still maturing: Community feedback indicates governance tooling is “still catching up,” and many organizations use a trust-but-verify approach. Conditional Access is often mistaken for governance when it only guards the front door.
Best for: Organizations deeply invested in the Microsoft 365 and Azure ecosystem that want agent identity governed within their existing Entra ID environment, especially those building agents through Copilot Studio or Azure AI Foundry.
Less ideal if: You need to govern non-Microsoft coding agents such as Claude Code or Gemini CLI as first-class identities. Entra Agent ID’s strength is within the Microsoft ecosystem, and cross-platform agent governance requires additional integration work.
Entra Agent ID is a strong choice for Microsoft-centric organizations. Security teams should still treat it as a foundation that requires careful permission scoping and awareness of consent-phishing risks.
Idira (formerly CyberArk, now Palo Alto Networks): Privileged Access Management for Agentic Identities
In February 2026, Palo Alto Networks completed its acquisition of CyberArk and subsequently launched Idira, a rebranded identity security platform combining modern PAM, machine identity security, and agentic identity governance.
Idira treats each AI agent as a privileged identity requiring the same session management, credential rotation, and just-in-time access controls as human privileged users.
- PAM-native approach to agent identity: Idira applies privileged access management discipline to AI coding agents through just-in-time credential issuance, session isolation, and automatic credential rotation, treating every agent action as a privileged operation.
- Unified platform for human and non-human privileged access: Security teams managing both human privileged users and AI coding agents can do so from a single platform, reducing the tooling fragmentation that plagues many organizations.
- Machine identity security for agent-to-API communication: Beyond agent governance, Idira secures the machine identities that agents use to authenticate to APIs, cloud services, and CI/CD tools.
Best for: Organizations in finance, critical infrastructure, or highly regulated industries where coding agents accessing production systems must be governed under the same privileged access controls as human administrators.
Less ideal if: Your primary need is lightweight, developer-friendly authorization for MCP tool calls rather than heavyweight PAM.
Idira brings PAM rigor to the agent identity problem, which is a natural fit for security teams that already think in terms of privileged access. The challenge will be balancing that rigor with the velocity that AI coding agent adoption demands.
Permit.io: Fine-Grained Authorization at the Point of Every MCP Tool Call
Permit.io approaches AI agent governance from the authorization layer. It offers a fine-grained policy engine that combines RBAC, ABAC, and ReBAC in a single platform deployable as a local PDP in your VPC.
- Per-tool-call authorization for MCP agents: The Permit MCP Gateway auto-generates authorization policies per tool when connecting an MCP server, evaluates every tool call against policy in real time, tracks the delegation chain from human to agent, enforces trust ceilings, and logs every allow/deny with full context.
- OPA and Zanzibar-style ReBAC under the hood: The policy engine uses OPA and a Zanzibar-style relationship graph, with a track record running application-level authorization for companies including Cisco and Intel.
- Local PDP for low-latency enforcement: The policy decision point can be deployed inside your VPC, so authorization decisions add minimal latency even at high request volumes.
Best for: Platform engineering teams that need fine-grained, per-tool authorization for AI coding agents, especially those building on the MCP protocol and wanting to enforce policy at the tool-call level rather than at the API gateway.
Less ideal if: You need a full identity provider, meaning authentication and identity lifecycle, rather than authorization alone. Permit.io is an authorization layer that integrates with existing identity providers; it does not replace them.
Permit.io’s laser focus on authorization makes it a compelling complement to existing identity providers. For teams that have authentication solved but need granular control over what each agent tool call can do, Permit’s MCP Gateway fills a critical gap.
WorkOS: Agent-Aware Identity with Developer-First Design
WorkOS Agent Auth, currently in early access, gives AI agents real identities in AuthKit with blueprints defining what an agent is allowed to do, issuing short-lived tightly scoped tokens, and supporting both user-delegated and autonomous agent access modes.
- Dual access modes for agent flexibility: WorkOS supports both user-delegated access, where the agent acts on behalf of a specific human, and autonomous agent access, where the agent has its own identity and permission set.
- Short-lived, tightly scoped tokens with instant revocation: Tokens issued to agents are ephemeral by design, reducing the blast radius of credential compromise. Revocation is instant across the platform.
- Also offers fine-grained authorization: Beyond AuthKit, WorkOS provides FGA capabilities for agentic workflows, enabling authorization decisions at the application layer alongside authentication.
Best for: SaaS platforms and developer-focused organizations building AI coding agent features into their own products, especially teams that value rapid integration and developer experience over enterprise IAM complexity.
Less ideal if: You need a hardened, compliance-certified identity platform for regulated environments. WorkOS is still maturing its agent identity capabilities, and its enterprise compliance coverage lags behind Okta and Ory.
WorkOS is the developer-friendly option for teams that want to move fast on agent identity without the overhead of traditional enterprise IAM. For organizations where compliance certifications and regulatory coverage are requirements, it is likely a future bet rather than today’s answer.
Caveats, Counterpoints, and What This Market Still Needs
The 2025 EMA survey found that 60.5% of organizations use a hybrid human/service account management model for their AI agents, revealing how far the market is from a cohesive identity strategy.
The same survey found that organizations report using an average of three IAM platforms, with 34% using four or more, making unified authentication of AI agents nearly impossible in the near term.
Meanwhile, 52.8% of organizations prefer an all-in-one IAM platform strategy for agentic AI, but only 24% have currently achieved this goal. The market is moving toward consolidation, yet a multi-vendor reality will persist.
That reality is one reason security leaders are starting to embrace the principle of treating AI agents as first-class identities. It means explicit delegation instead of impersonation, unified identity frameworks for human and non-human actors, and transparency as a default.
A final cautionary figure from the SpyCloud 2026 report: NHI-related misuse was the most commonly reported identity-based event type at 42%, yet 95% of organizations believe they have adequate visibility into AI- and NHI-related exposures while only 36% actually monitor them.
That gap between confidence and actual monitoring is where the next wave of breaches will likely surface.
Final Verdict
The AI coding agent identity market in 2027 is defined by a tension between platform consolidation and best-of-breed specialization. Ory leads with web-scale identity infrastructure proven on one of the largest AI platforms in the world, making it the strongest option for organizations that need composable, API-first IAM capable of handling extreme throughput.
Okta and Idira offer maturity and regulatory coverage for enterprises in regulated industries. Teleport, Permit.io, WorkOS, and Microsoft Entra Agent ID each address specific deployment contexts: infrastructure access, fine-grained authorization, developer velocity, and Microsoft ecosystem integration.
Security leaders should choose based on existing identity platform investments, regulatory requirements, and whether the priority is authentication scale, authorization granularity, or privileged access rigor.
