--- title: "Identity" description: "8 posts about Identity, summarised, each linking to the original." --- # Identity > 8 posts about Identity, summarised, each linking to the original. ## Articles ### [What is agentic identity? Securing AI agents in 2026](https://yomu.fyi/post/what-is-agentic-identity-securing-ai-agents-in-2026.md) - Company: [Twilio](https://yomu.fyi/company/twilio.md) - Author: Ravleen Kaur - Published: Oct 15, 2026 - Type: Explainer AI agents are shifting from passive copilots to autonomous actors that book tickets, update calendars, and send messages without step-by-step human intervention. This shift introduces operational risks because traditional security controls designed for deterministic software cannot handle non-deterministic agent behavior, leading to over-permissioned agents, rogue behavior, and lack of real-time monitoring. Agentic identity is proposed as a governance layer built on three pillars: authentication (cryptographic keys), authorization (contextual permissions), and context (delegated link to end user). The framework includes short-lived session tokens, user context binding via token exchange, hard operational bounds on tool calls, human-in-the-loop gateways for high-risk actions, verified communication endpoints, and centralized logging with kill switches. By implementing these controls, organizations can deploy autonomous agents safely while maintaining visibility, containment, and auditability across all agent actions. ### [Auth0 Metadata Explained: user\_metadata vs app\_metadata](https://yomu.fyi/post/auth0-metadata-explained-user-metadata-vs-app-metadata.md) - Company: [Auth0](https://yomu.fyi/company/auth0.md) - Author: Carla Urrea Stabile - Published: Oct 5, 2026 - Type: Explainer Auth0’s user\_metadata and app\_metadata define a security boundary: user\_metadata is writable by users through the update:current\_user\_metadata scope, while app\_metadata requires privileged scopes available only to confidential clients via the client credentials grant. Post-login Actions reading authorization data like subscription plans or feature flags from user\_metadata allow users to escalate privileges by modifying their own metadata, for example setting plan to enterprise and beta\_access to true. Writing to app\_metadata demands a server-side M2M application with update:users\_app\_metadata scope, which no public client or user token can obtain. The correct practice is to store access-control data such as roles, tenant membership, and IP allowlists in app\_metadata, and non-sensitive preferences like theme or language in user\_metadata. A third field, client\_metadata, holds application-level properties readable via event.client.metadata in Actions. ### [Architecting Secure Identity: Extending Auth0 PrivateLink with Intelligent Gateways](https://yomu.fyi/post/architecting-secure-identity-extending-auth0-privatelink-with-intellig.md) - Company: [Auth0](https://yomu.fyi/company/auth0.md) - Author: Daryl Martis - Published: Oct 2, 2026 - Type: Problem & solution Enterprises centralize authentication into a single Auth0 environment but must comply with frameworks like PCI-DSS, HIPAA, and SOC 2 that restrict data to private channels. Auth0 Outbound PrivateLink provides a secure unidirectional connection between Auth0 and AWS infrastructure, avoiding the public internet. However, a single PrivateLink connection per environment cannot directly reach multiple isolated VPCs for staging and production. The Intelligent Gateway Pattern solves this by deploying an API gateway or reverse proxy at the PrivateLink termination point to fan out traffic. Auth0 Actions append context such as custom headers like X-Target-Env or specific paths, and the gateway inspects these to route requests to the appropriate isolated VPC, decoupling secure transport from internal routing. This pattern unblocks identity consolidation by allowing a single Auth0 tenant to serve both staging and production workloads while maintaining strict VPC isolation. ### [Connecting customer context to measurable ROI with agentic marketing](https://yomu.fyi/post/connecting-customer-context-to-measurable-roi-with-agentic-marketing.md) - Company: [Databricks](https://yomu.fyi/company/databricks.md) - Author: Elena Tesser, Alexandra Haefele - Published: Oct 1, 2026 - Type: Explainer Customer journeys have become non-linear while identity signals decay, and marketing value is shifting from reach frequency to a prediction economy that rewards anticipating needs. AI agents can recommend or take the next-best action for each customer within human-defined guardrails, with each action measured incrementally against what would have happened without it. Identity resolution must be continuous, connecting known and pseudonymous signals across channels, to provide reliable context for agent decisions. The context required includes customer behavior, business objectives, decision history, and control guardrails, with a single transaction carrying up to 50 metadata parameters. A practical starting point is focusing on one meaningful decision, such as reactivating lapsed customers, and expanding as trust and results build. ### [Introducing SCIM Provisioning in ClickHouse Cloud](https://yomu.fyi/post/introducing-scim-provisioning-in-clickhouse-cloud.md) - Company: [Clickhouse](https://yomu.fyi/company/clickhouse.md) - Published: Sep 30, 2026 - Type: Announcement ClickHouse Cloud introduces SCIM 2.0 provisioning, making the identity provider the single source of truth for user membership and role assignments. Previously, SAML SSO handled authentication but left user invites and role updates as manual tasks, creating security risks. SCIM provisioning automatically syncs user create, update, and delete operations from the IdP using standard SCIM 2.0 endpoints, maps IdP groups to custom ClickHouse roles via stable external IDs, supports up to two API keys for rotation, and provides audit logging for all provisioning actions. The feature requires an active SAML connection, is limited to verified domain SSO users, excludes system roles like Admin, and revokes all keys if SAML is disabled. It is generally available for Enterprise and BYOC organizations, validated with Okta and Microsoft Entra ID, and eliminates manual invite and deprovisioning tasks. ### [Seven Architectural Readiness Checks Before Production Launch](https://yomu.fyi/post/seven-architectural-readiness-checks-before-production-launch.md) - Company: [Auth0](https://yomu.fyi/company/auth0.md) - Author: Carlos Aguilar - Published: Sep 30, 2026 - Type: Tutorial Auth0’s free tier supports up to 25,000 MAUs for MVPs, but teams must complete seven architecture checks before production launch to avoid blockers. The checks cover Auth0 Organizations for multi-tenancy, Enterprise Connections for SSO, Custom Domains, JIT hash migration, Fine-Grained Authorization, MFA factor progression, and tenant lifecycle management. The free plan caps Organizations at five, Enterprise Connections at one plus unlimited Okta, and MFA at passwordless and passkeys only. Upgrading to B2B Essentials or Professional unlocks unlimited organizations, up to five enterprise connections, and advanced MFA including TOTP, WebAuthn, push, and SMS; Professional also enables Custom Database migration scripts. Teams must add a credit card for Custom Domains, add a secondary admin to prevent tenant deletion after 150 days of inactivity, and note that FGA free trial supports 100 MAUs and 50,000 tuples for prototyping. ### [Introducing IdentiFlows.dev: A Visual Reference for Identity Flows](https://yomu.fyi/post/introducing-identiflows-dev-a-visual-reference-for-identity-flows.md) - Company: [Auth0](https://yomu.fyi/company/auth0.md) - Author: Andrea Chiarelli - Published: Sep 29, 2026 - Type: Announcement Developers often struggle to quickly find accurate sequence diagrams for OAuth 2.0 and OpenID Connect flows. IdentiFlows.dev is a new website that provides a visual reference for common identity protocols, organized into four categories. Each flow page includes an introduction explaining the flow’s purpose, a sequence diagram showing the full exchange, and a step-by-step breakdown of each stage, with an interactive mode to walk through the steps. The initial release covers eight flows, including OAuth 2.0 Authorization Code with PKCE, the recommended login flow for most modern apps, SAML 2.0 SP-Initiated SSO, DPoP-Bound Access Token requests, and OpenID Connect Discovery. The project is an early release with plans to add more flows like Client Credentials, Device Authorization, and WebAuthn, and the author invites feedback to guide development. ### [Securing Agentic Commerce Using Auth0 and the Universal Commerce Protocol (UCP)](https://yomu.fyi/post/securing-agentic-commerce-using-auth0-and-the-universal-commerce-proto.md) - Company: [Auth0](https://yomu.fyi/company/auth0.md) - Published: Sep 28, 2026 - Type: Announcement Auth0 is bringing secure identity to the Universal Commerce Protocol (UCP) so retailers can safely let AI agents discover and purchase products on shoppers’ behalf. UCP is an open standard that gives AI agents a consistent way to interact with a merchant’s catalog, cart, and checkout, reducing the need for separate integrations per platform. Auth for UCP provides the identity and trust layer, handling agent registration, account linking, and scoped temporary token issuance through an on-behalf-of token exchange. This ensures that every purchase ties to a verified human with time-limited access and a full audit trail, while agents see only the authenticated shopper’s data. Auth0 is opening Auth for UCP Limited Early Access to select customers through its Agentic Commerce Partnership Program.