Identity as Control Layer

The important shift is that identity is no longer just about logging a person in, it is becoming the control layer for every action an agent can take after login. Before agents, most consumer apps only needed to verify a user and keep a session alive. With remote MCP servers and OAuth based delegation, those same apps now need consent screens, scoped tokens, revocation, audit logs, and role rules that separate what a human can do from what that human’s agent can do.

• This pulls consumer software toward enterprise style authorization. Stytch describes B2B apps as already needing role based controls like admin, support, and developer permissions, while consumer apps usually did not. Agents change that because a shopping, finance, or productivity app now has to decide which read actions, write actions, and approvals an agent gets.
  1 sacra 2 sacra
• The closest historical parallel is Google account delegation. Products like Calendly and Superhuman work because Google acts as an OAuth identity server, letting a user grant limited access to calendar or email. Stytch’s bet is that thousands of apps that were never built this way now need the same machinery so they can be safely used through Claude, ChatGPT, and other agent clients.
  1 sacra 3 modelcontextprotocol 4 anthropic
• This also expands the competitive set. WorkOS has already moved from SSO and directory sync into fine grained authorization and delegated connection products, and newer companies like Keycard are being built specifically around agent identity, short lived credentials, and delegation chains. That shows the market is broadening from login tools into policy and control infrastructure for machine action.
  5 sacra 6 sacra 7 sacra

The next phase is that identity vendors will sell less on sign in screens and more on policy enforcement for agent workflows. As more software exposes MCP endpoints and OAuth protected actions, the winning platforms will be the ones that can turn any app into a safe identity server quickly, then layer in approval steps, audit trails, and fine grained permissions without forcing a full rebuild.