This year, I’ve gone around the world speaking about identity ownership and modern authorization problems spurred by the agentic revolution. Inevitably, the first question I hear starts with someone expressing a nagging worry — their own, and their organization’s — about the agents they don’t own and can never fully control.
I think I’ve got the beginnings of a new kind of answer, and it looks like U4A.
Put bluntly, the question is becoming: may your agent touch my stuff? Answering it robustly needs a way to express authority on the resource owner’s side, a way for someone else’s agent to ask for access, and protection that still holds even when third-party agents are innumerable.
That’s the problem UMA for Agents (U4A) takes on, with an approach we’ve come to call decentralized authorization: the authority stays with each resource owner, however many agents come asking. On Thursday, November 19, the work and I have been doing on it moves into the Kantara UMA Work Group as a candidate update to the UMA standard. The kickoff is at the work group’s 1 PM ET meeting that day, and WG chair Alec Laws has put together a proposed agenda here.
UMA is home turf for me. I founded the group with like-minded technologists in 2009 and chaired it for many years, often serving in a larger role some called “Chief UMAnitarian.” 😊 I’ve long been passionate about enabling selective sharing for people. We UMAnitarians built it so that resource owner Alice sets policy once, and other parties negotiate against that policy even while she’s offline.
Last year, many people asked me if UMA applies in the agentic world. UMA predates the agent era, yet the questions made sense: when software acting for someone else asks for access to what’s yours, it would be very nice to have an answer that isn’t “Ban all the things!”
In response, I wrote what turned out to be my most popular post here to date; check it out for a brief UMA explainer:
One thing I’ve become convinced of along the way: there will be many ways to identify agents, and that’s fine. We’re up to, what, a dozen methods of identifying, describing, and registering agents now? I say, let a thousand agent identity flowers bloom. What matters more is how much liability the party behind a legitimate agent is willing to take on.
U4A doesn’t start from a blank page (that older post really got the wheels turning). Thanks to Nick’s ministrations, there’s a working proof of concept, an Apache 2.0 licensed reference implementation with a Kubernetes lab you can run in GitHub Codespaces, and a set of specification proposals. It’s all very much a draft, and that’s why we want to hear your feedback in the Work Group.
If this is your problem too, here’s how to help:
Join the Kantara UMA Work Group. It’s free and takes a couple of minutes: kantarainitiative.org/gpa-signup. The technical work happens under the work group’s “RAND-RF” IPR policy. For extra credit — it gives you more Work Group participation rights — become a member of the Kantara Initiative as a whole.
Bring your use cases. I’m hearing two reciprocal use cases so far, and I bet there are more:
Alice is a resource owner: Businesses want to ensure that customer Alice’s terms for personal data access are provably included in the stack of PII access protections they apply to all requesters, including agentic ones.
Bob and his agent are on the requesting side: Businesses want to ensure that when customer agents show up to transact (e.g., buy stuff) on customers’ behalf, back-end systems can gracefully handle the onslaught and form the right kind of permeable barrier.
Here’s a question to take into the meeting, or to answer in the comments: if an agent you don’t own asked for access to your organization’s data tomorrow, who on your side would get to say yes?
Cut through IAM complexity and transform your strategy with Eve Maler's research-backed insights.
