Zalando open-sources an identity broker for AI agents acting on users’ behalf

Zalando has open-sourced an MIT-licensed identity broker designed to let AI agents use third-party services without directly holding users’ provider tokens. The important shift is architectural: consent, delegation and access checks move into a broker, rather than being left for every agent and MCP server to improvise.

Watch Desk analysis

What happened

Zalando’s engineering team says the Agentic Identity Broker captures delegation chains, proxies OAuth 2.0 tokens and makes access decisions by intersecting the user’s permissions with the agent’s permissions. The project is built on Kubernetes and uses tools including kagent and agentgateway.

In practical terms, an agent could act for a person across connected services while the underlying provider token remains outside the agent itself. The broker also centralises consent, which could give organisations one place to see and control how authority is handed to software.

The project is released under the MIT licence, so developers can inspect, adapt and integrate the component rather than treating identity management as a proprietary black box. Zalando’s account does not establish how the broker performs under attack, how easy it is to operate or whether it has been independently audited.

Why it matters

AI agents are moving from answering questions to taking actions, and action requires credentials. Giving every agent a collection of long-lived tokens is a tidy route to a very untidy incident. A broker offers a more controlled alternative: the agent requests authority, the system checks what both the person and the agent are allowed to do, and access can be managed centrally.

That does not make delegated access safe by magic. It does make the boundary visible, testable and potentially revocable. For teams connecting agents to email, business systems or MCP tools, that is considerably more useful than another demo in which the software cheerfully clicks around until something breaks.

Our read

This is a substantial infrastructure release, not just an agent wrapper with a new hat. The strongest idea is the permission intersection, because an agent should never inherit more authority than the person granting it, and a person’s authority should not automatically legitimise every tool the agent can reach.

The project is worth examining for teams building serious agent systems, but the MIT licence is not a security certificate. Before deployment, organisations should inspect the code, understand token lifetimes and revocation, test confused-deputy scenarios, and establish who owns each delegation chain.

What to watch

• Independent security review:
  Whether researchers identify weaknesses in token proxying, consent or delegation-chain handling.
• Operational adoption:
  Whether other organisations use the broker beyond Zalando’s own platform context.
• Revocation behaviour:
  How quickly access disappears when a user, agent or downstream service loses permission.
• MCP integration:
  Whether the design becomes a practical standard for controlling agent access to connected tools.

Discussion spark: Should AI agents receive short-lived, brokered permissions by default, even if that makes integrations harder, or is the extra identity layer too much machinery for most useful automation?

Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.