Third-party cookies are disappearing, and many “Sign in with X” flows built on embedded IdP iframes depended on them. FedCM (Federated Credential Management) is browser’s replacement: instead of the RP embedding the IdP and reading its cookies, the browser handles the identity flow and returns an identity token.
Enterprise IAM assumes whoever’s on the other end of a login is a human. AI agents break that assumption, not with some clever new attack, but by walking straight through shortcuts we’ve always taken: screen-level permissions instead of API-level ones, one consent prompt per app, identity lifecycles tied to HR events instead of agent lifecycles.
Whether you’re building a massive SaaS platform or a niche API, OAuth is the standard for authorization. But every OAuth setup runs into the same wall eventually: registration.
Every time a user clicks “Sign in with Google” or gets SSO access to a third-party app from a corporate IdP, identity crosses a trust boundary. Identity proofing happened somewhere, authentication happened somewhere else, and now another system needs to rely on that result.
