# Gateway-enforced zero-trust with token exchange secures agentic identity for AI agents

Agentic identity is the practice of identifying, authorizing, and constraining AI agents as they act on behalf of users across models, APIs, tools, and other agents. The talk argues that this problem builds on zero-trust and workload identity patterns but becomes harder because agents need broader, more dynamic access, often require multiple downstream credentials, and behave non-deterministically, which makes destructive actions like deleting data or making transactions harder to trust than simple reads. The recommended design pattern is to put a gateway or similar control point in the middle so agents carry a primary identity for themselves and the user they represent, while the gateway enforces network boundaries, evaluates policies across the full user-agent chain, and performs token exchange, federation, or token vaulting to obtain scoped credentials for external services. It also highlights user and agent attestation, human-in-the-loop approvals, mission context, and stateful policies as emerging controls.