Agentic IAM with Vault

Vault Enterprise enables an agent or other AI application to authenticate with an OAuth access token that carries a Rich Authorization Request (RAR) claim. An identity provider (IdP) functions as an authorization server to issues the RAR tokens.

Using a least-privilege approach implements zero trust principles by ensuring agent credentials are ephemeral and narrowly scoped through delegation. The agent acts on behalf of a human developer and receives an effective permission set that is the intersection of three independent controls:

1. Human baseline ACL policies define what the person can do

2. Agent ceiling policies from the Vault Agent Registry cap the maximum the agent can ever do

3. Per-session RAR claims carried in the token specify what one session may access

For example, you can configure IBM Verify to function as an authorization server. IBM Verify then issues OAuth RAR tokens to an agent or other AI applcation, which that agent or application can then use to authenticate with Vault.

How the request flow works

The diagram illustrates the workflow where the human user (the subject) authenticates with an IdP (e.g, IBM Verify) and how the AI agent (on behalf of the user) can use the delegated RAR token issued by Verify to authenticate with Vault.

Vault enables an OAuth resource server to validate the JWT presented by the AI agent or application (the actor). Vault knows about The AI agent or application identity informagion through registration in the agent registry.