Over the past seven days, a single line buried in an enterprise security newsletter moved more procurement conversations than any token price on the board: Aembit became the first third-party enforcement point for Okta's Cross-App Access protocol, known as XAA. On its face, this is a niche integration — one vendor plugging into another vendor's identity standard. In practice, it is a tell. It is a small, quiet signal about who will govern the autonomous agents now flooding into corporate networks, and who will be governed by them.
I have spent fifteen years in this industry, and I have watched it promise decentralization while quietly rebuilding centralization, over and over, in new costumes. I audited whitepapers through the 2017 ICO bubble, reading mission statements that swore to remove trusted intermediaries. I resigned from an analytics role during DeFi Summer because the yield incentives were preying on users who could not read the fine print. I spent two months in a Virginia cabin during the 2022 crash rereading Hayek and Turing, trying to understand why an industry built on trustlessness kept crowning new trust. So when I read that a company had "won" the right to be a checkpoint inside another company's protocol, my first instinct was not excitement. It was recognition.
Bulls react. Bears reflect. We build. And builders owe themselves a harder question than "who won the integration."
Let me set out what actually happened, stripped of the press framing.
Okta formalized XAA — a protocol for extending OAuth 2.x authorization to non-human identities, specifically AI agents calling APIs through the Model Context Protocol. Anthropic open-sourced MCP in late 2024 and defined an OAuth 2.1 authorization specification within it. XAA is the enterprise-side profile built on top: a way to tell an agent, "you have been authenticated, and here is precisely what you may do, for how long, and under what conditions."
Architecturally, this is not a new paradigm. It is the recombination of two mature ideas — the OAuth authorization framework and the NIST Zero Trust model of policy decision points and policy enforcement points. What XAA does is apply that machinery to a new kind of actor: the autonomous agent, which is neither a human user nor a static service account. The agent is a third category of identity, one that acts on its own, at machine speed, in volumes no human reviews.
Aembit's role in this is specific and worth stating plainly. It does not sell an identity product. Identity is already commoditized — Okta, Microsoft, and Snowflake all shipped agent identity capabilities in the same quarter. What Aembit sells is the enforcement layer: the runtime checkpoint that intercepts an agent's actions after authentication and enforces policy on what the agent may actually do. And it sells a translation layer for what the coverage calls "mixed identity" — the ability to mediate between XAA-native agent identities and the legacy SSO, OAuth, and service accounts that enterprises refuse to rip out.
That last detail matters more than the headline. The existence of a translation layer is itself an admission. You build a translator when two sides do not yet speak the same language. Its presence is proof that almost no enterprise runs native agent identity today. The standard is a future, not a fact — and anyone selling you "accelerating ecosystem formation" is selling you a timeline, not a deployment.
Now the analysis, and the part the press release buries.
The dominant narrative in this coverage is "value migrates upward." Authentication is table stakes — free, commoditized, undifferentiated. The real moat, the argument runs, is the execution and governance layer, the runtime that decides what an authenticated agent may actually do. This is presented as the sophisticated, contrarian take. It is also, in my read, half true and half wishful.
Start with the half that is true. The history of Identity and Access Management supports the migration thesis. SAML and OIDC made authentication effectively free. Authorization and policy then moved up the stack — OPA, Cedar, AWS Verified Permissions. Governance is now moving up again. Agent identity is repeating the path. I watched the same pattern play out in crypto with oracles: the "boring" data layer commoditized, and value concentrated in whoever controlled the integration.
But here is where the analogy turns dark, and where I part ways with the optimists. In DeFi, we told ourselves Chainlink solved the oracle problem by decentralizing it. It did not. It solved it by becoming a node network that everyone agreed to trust — and that network, in practice, is far more centralized than the marketing admits. That is a covenant, not a code property. Covenants hold only as long as the community chooses to honor them; they are not enforced by the protocol. XAA has the same shape. The "execution layer moat" assumes the platform owner wants an open execution layer. It assumes Okta will not build runtime enforcement directly into the platform, that Cloudflare will not bundle it as a free edge feature, and that Anthropic will not fold enforcement into MCP itself. None of those assumptions is safe. Any one of those three actors can commoditize the enforcement point overnight.
The layer you build on top of is never the layer you control. Aembit is a builder on Okta's protocol. The standard-setting power sits with Okta — the roadmap, the specification, the ability to change the interface. That is not a partnership of equals. It is a tenancy. And tenants do not set the rent. The coverage describes Aembit's position as "betting on the execution layer." It is more accurate to say Aembit is renting a room in a building it does not own, and hoping the landlord never decides to open a competing shop downstairs.
There is a quieter flaw in the bull case, and the analysis I reviewed omits it entirely: the enforcement point is itself a chokepoint.
Think about what a runtime enforcement point actually is. It sits in the middle of every agent-to-API call. Every authenticated action passes through it. It holds the policy, sees the request, and decides. In security architecture, we have a precise name for a component that sits in the middle of every transaction and must be trusted to be both available and correct. We call it a single point of failure. And in adversarial terms, a single point of compromise.
The irony is sharp. Aembit's entire value proposition is security — stopping agents from over-reaching, from being hijacked by prompt injection, from acting as a "confused deputy" with more privilege than the user who triggered them. These are real and serious threats. A confused-deputy attack, where a high-privilege agent is manipulated by a low-privilege user, is a classic authorization vulnerability, and the enforcement point is precisely the control designed to stop it. Yet the coverage never once asks about the enforcement point's own attack surface. If an attacker compromises the checkpoint, every agent behind it loses its leash at once. If Aembit becomes the shared enforcement point for hundreds of enterprises, its breach is not an incident. It is a supply-chain event, the kind that ends in a congressional hearing.
I have seen this exact structure before, in DeFi. We centralized the oracle because decentralized price feeds were slow and expensive to run. Then we discovered that a single manipulated feed could drain every protocol that depended on it, in one block. The efficiency of centralization is always real. It is always paid for later, usually by someone who did not know they were exposed.
Consider the enforcement point's core job once more. It must evaluate dynamic, adversarial behavior — an agent nudged by a crafted prompt into a call it should never make — using policies that are, by nature, static and pre-written. A static rule set trying to contain a dynamic attacker is an arms race the rule set usually loses. The enforcement layer is necessary. It is not sufficient. And the coverage presents it as a solved control when it is an ongoing, contested one.
So the "moat" is really a bet with two sides, and the bet is not Aembit's to control. If the enforcement layer stays open, it can become a standard reference implementation, and early position pays off. If the platforms close it — build it in, bundle it free, absorb it — the independent enforcement vendor becomes a transitional artifact, valuable for a few years and then written out of the architecture. A moat that requires the platform owner to keep choosing not to compete is not a moat. It is a hope, dressed in the language of strategy.
Here is what is missing from every version of this story I have read: numbers. There is no pricing model, no average contract value, no disclosed customer count, no recurring revenue, no total addressable market. For a company positioning itself as the toll booth on agent traffic, the absence of unit economics is not a minor omission. It is the whole question. In crypto, we learned to distrust any protocol that could describe its mechanism in detail but not its revenue. The enforcement layer's budget comes from security and compliance, not from efficiency, which means long sales cycles and hard ROI proof. A "governance premium" is a hypothesis, and the coverage admits as much — it calls capturing that premium "the key question," not a solved fact. A hypothesis is not a moat either.
There is a deeper layer here, and it is the one I actually care about.
The coverage frames this as a technical story about scaling agent infrastructure. But it is a governance story about who holds the keys to machine identity. When a handful of platforms define the identity protocol for autonomous agents, we are not merely choosing a technical standard. We are choosing where sovereignty over machine action lives. In this design, the answer is: with the platform.
This is the covenant-over-code problem in a new costume. The code — XAA, MCP, OAuth — looks neutral, and that neutrality is its most seductive feature. It is not neutral. The covenant that decides who may override a policy, who may revoke an identity, who may inspect an agent's actions, sits with the small group of administrators who control the platform. In DAO governance, we learned the hard way that "code is law" is a fiction, because the upgrade rights always sit with a few multi-sig holders. The protocol says the community governs. The multi-sig says otherwise. Agent identity is the same fiction at a larger scale. The protocol says the agent has these rights. The platform decides whether it actually does.
Ask the question the coverage never asks: is XAA submitted to a neutral standards body, or is it Okta's private protocol with an open door? The material shows no IETF or OASIS ratification. If XAA remains vendor-owned, then every participant is building on a foundation that a single company can rewrite. That is the opposite of a covenant. A covenant binds the powerful and the weak alike. A vendor protocol binds only the tenants.
Now the four-layer framework the analysis proposed, because it is the most useful part of the discussion — and the most alarming when read honestly.
The framework says agent infrastructure is standardizing along four layers: identity (Okta XAA, SSO, MCP authentication), events (MCP Events), sandbox (Cloudflare, Vercel, and open runtimes), and governance (NVIDIA's OASP and similar). Each layer is commoditizing. Value, the argument goes, concentrates in the layer that resists standardization — execution and governance.
Read that list again, slowly. Every single layer is being defined by a platform vendor, not a neutral standards body. Identity by Okta. Sandbox by Cloudflare. Governance by NVIDIA. There is no visible IETF process here, no OASIS ratification in the material. We are watching a privatized standardization, where each layer's "standard" is simply whoever shipped first and had the distribution to enforce it. That is not how open protocols are supposed to form. That is how fiefdoms form.
This is the same mistake crypto made at scale. We let "standards" emerge from whoever had the largest balance sheet and the loudest ecosystem, and we called it decentralization because the code was open. But the code was never the point. The governance was. And the governance was always private. Agent identity is about to repeat the error, and this time the stakes are higher, because the actors being governed are not tokens. They are machines with the ability to act.
There is one more signal worth naming, because it is easy to miss. The translation layer.
Aembit's differentiated capability is mediating "mixed identity" — bridging XAA-native agents and legacy enterprise authentication. The coverage treats this as a clever integration play. I read it as a diagnostic. The translation layer tells you that the new standard has near-zero native penetration. Enterprises are not running XAA agents. They are running legacy stacks, experimenting at the edges, and paying someone to make the old and new coexist. That is a real business. It is also a transitional one. Once enterprises complete an agent-native identity migration — if they ever do — the translation layer's value decays. The mixed-identity moat is a moat designed to be drained by its own success.
I watched this exact dynamic in crypto's Layer 2 wars. Dozens of rollups launched, each claiming a unique position, each dependent on a migration of users and liquidity that never fully arrived. The scaling that was promised was really fragmentation — scarce activity sliced into thinner and thinner fragments. The identity translation layer may be the same: a bridge that is only valuable while the gap exists, and whose builders are betting the gap stays open longer than it should.
To be fair to Aembit, this is not a foolish bet. It is a clear-eyed bet on a real constraint — enterprises will not dismantle their authentication stacks to deploy agents. Someone has to bridge that gap, and bridging it well requires deep compatibility work across dozens of SSO and OAuth implementations. That is genuine engineering difficulty, and difficulty is a form of protection. But difficulty is not durability. The bridge that is hard to build is still a bridge that becomes unnecessary when the river dries up.
From an investor's seat, agent identity sits squarely in the hottest security sub-sector of the cycle — non-human identity management, where CyberArk, Astrix, and a dozen others have raised heavily. Agent identity is its extension and upgrade. Aembit's capabilities — enforcement plus mixed-identity translation — would be a clean acquisition for Okta, CyberArk, Palo Alto, or Microsoft. That acquisition path is real, and it is the most likely outcome. But acquisition potential is not the same as standalone value, and a company whose distribution depends on a platform it does not own has already discounted its own independence. The most likely exit is also the most honest signal: middleware that gets bought is middleware that was never allowed to become a platform.
Let me state the contrarian read plainly.
The story everyone is telling is "the enforcement layer is the new moat, and Aembit got there first." The story I see is "the platform defined the standard, invited tenants into a layer it can absorb at will, and the tenants are calling their tenancy a moat." The first read is optimistic and fits the funding narrative. The second read is structural and fits the history. In this industry, history has been the better guide.
The bear case is not that agent identity fails. Agent identity will succeed. The demand is real, the compliance pressure is real, the security need is real. The bear case is about who captures the value when it does. The pattern across crypto and cloud alike is consistent: the platform captures it, the middleware rents it, and the middleware's window closes when the platform decides the rent is too high. The only variable is how long the window stays open.
There is also a quieter blind spot. The coverage treats "security" as the enforcement layer's product, but never asks who bears the liability when the layer fails. If an agent over-reaches and causes harm, is the responsibility with the agent's developer, the deploying enterprise, or the enforcement vendor that was supposed to stop it? No clear legal framework answers this yet. An enforcement vendor is quietly accepting an enormous, unpriced responsibility, and calling it a moat. That is not a position of strength. It is a position of exposure that has not yet been marked to market.
And beneath all of it runs the deepest assumption of the entire narrative: that the platform owner will keep choosing openness. That assumption is not a law of nature. It is a courtesy, revocable at will, extended by an actor whose interests will eventually diverge from its tenants'. The moment Okta decides that enforcement is a feature worth owning outright — and platform owners almost always do — the "open execution layer" becomes a footnote in a changelog. The tenants will not be consulted. They will be informed.
So here is my forward-looking judgment, offered not as a prediction but as a question worth carrying into every agent deployment this year.
When your agents authenticate and act, who holds the override? Who can revoke an identity at three in the morning? Who reads the audit log, and who can alter it? If the answer is a platform you do not control, then you have not deployed a sovereign agent. You have deployed a tenant. And a tenant's rights last exactly as long as the landlord allows.
The machine identity layer is being built right now, in public, by a handful of platforms that have every incentive to concentrate the keys. We have a narrow window to insist on something better — neutral governance, composable enforcement, contestable covenants. After the window closes, we will spend another decade rediscovering that the code was never the point, and writing essays about why the trust we removed came back under a new name.
Tech changes. Values remain. Verify the code, trust the community — and when the community is a single vendor's ecosystem, verify twice.
