What is agentic IAM?

Vault Enterprise Agentic IAM enables organizations to enforce fine-grained, least-privilege authorization for AI agents using the OAuth 2.1 Rich Authorization Requests (RAR) extension. When an AI agent presents an OAuth JWT access token, Vault evaluates the embedded RAR claims and enforces access based on the agent's operating context and configured policies.

Vault supports either an Identity Provider (IdP) or a dedicated authorization server as the authorization authority. This flexibility lets you apply ephemeral, narrowly scoped permissions whether an agent acts autonomously or on behalf of a human user — a foundation for zero-trust agentic workflows.

Vault recognizes two agentic scenarios:

On-Behalf-Of (OBO) delegation — the agent acts for a human user. Vault derives the effective permissions from the intersection of three controls:

1. Human baseline ACL policies — define what the person is permitted to do.
2. Agent OBO ceiling policies (from the Vault Agent Registry) — cap the maximum the agent can ever inherit, regardless of what the authorization server granted.
3. Per-session RAR claims in the access token — specify what this individual session may access.

This three-way intersection ensures delegated actions stay within both the user's and the agent's authorized boundaries.

Autonomous agents — the agent acts with its own identity and no user delegation. Vault evaluates:

• The agent's baseline ACL permissions.
• Scope and authorization constraints in the JWT access token.

Setting agent policy controls for autonomous and delegation scenarios

Vault provides two policy types for these workflows:

1. Agent Baseline policies
2. Agent OBO ceiling policies

The agent baseline policies are access control list (ACL) policies that define the capabilities an agent can acquire for its assigned tasks. You write them the same way as any other Vault ACL policy.

Define agent baseline policies for autonomous agents that access secrets without human delegation.

Use the OBO ceiling policies when the agent is acting on behalf of the user. The OBO ceiling policies act as preventive security guardrails and set the maximum permissions that an agent can acquire from Vault, regardless of any excess permissions that may have been granted by upstream authorization servers.

The OBO ceiling policies act as a catch-all safety control to prevent any unintended grants to the agent (malicious or otherwise) that could result in harm to the system.

Define OBO ceiling policy whenever the agent will act on behalf of a human user. Before you create OBO ceiling policies, decide the maximum permissions the agent can inherit from the user, based on risk. The agent can only perform tasks within those limits. If the OBO ceiling policy is very restrictive, then the agent can only execute tasks based on the limits of OBO ceiling policy constraints.

Summary: Vault agentic policy controls

Review the Set up OBO delegation overview for introduction to setting up OBO.

Agent request flow for OBO delegation with RAR

Vault supports using either an IdP that acts as the authorization server or a separate, dedicated authorization server. This flexibility enables least-privilege, ephemeral authorization for both autonomous agents and agents acting on behalf of users.

By combining delegated authorization with narrowly scoped, short-lived access tokens, organizations can apply zero trust principles to agentic workflows.

Review the Rich Authorization Requests (RAR) overview for a deeper dive into how RAR works with Vault.

The diagram illustrates the workflow where the human user (the subject) authenticates with an IdP (fr example, IBM Verify) and how the AI agent (on behalf of the user) can use the delegated RAR token issued by Verify to authenticate with Vault.

Supported identity providers

Vault works with any compliant IdP, including the following: Auth0, IBM Verify, Okta, Microsoft Entra ID and PingFederate Identity Providers.