SCIM for AI: How the New IETF Draft Redefines Identity Management for Agents and Agentic Applications

Over the past decade, SCIM (System for Cross-Domain Identity Management) has been vital for user provisioning in enterprises, allowing identity providers like Okta and Azure AD to manage user accounts across various SaaS applications. However, the rise of AI agents, which operate in corporate systems without a consistent identity model, has prompted a new IETF draft titled "Agents and Agentic Applications" to extend SCIM's reach to these digital workers. This proposal introduces new SCIM resource types for agents and agentic applications, enabling a standardized framework for provisioning, governing, and deactivating AI agents, similar to human users. The draft highlights the importance of managing AI agents' identities, emphasizing security, auditing, and automation implications, and proposes a hybrid approach for schema compatibility to ensure seamless interoperability. By defining ownership, credential lifecycle management, and app-agent boundaries, the draft aims to bring accountability and traceability to AI ecosystems, aligning with platforms like SSOJet to extend identity management beyond human users, thereby bridging human and machine governance.