As browsers move to limit third-party cookies and tracking, conventional federated identity flows which require third-party cookies can cause privacy and compatibility issues. FedCM (Federated Credential Management) addresses this by letting the browser mediate the communication between the Identity Provider (IdP) and the Relying Party (RP) so that federated sign-in can be performed without third-party cookies.
Enterprise IAM assumes whoever’s on the other end of a login is a human. AI agents break that assumption, not with some clever new attack, but by walking straight through shortcuts we’ve always taken: screen-level permissions instead of API-level ones, one consent prompt per app, identity lifecycles tied to HR events instead of agent lifecycles.
Everyone mostly understands the OIDC login flow correct. It’s simple and staight-forward, you do the authorization code flow, validate the ID Token, set a session cookie, and done. Logout is where things becomes a bit complex and they usually happen silently.
This is part 2 of nuts and bolts of OAuth 2.0, continuing part 1. In this section, I’ll explore the client credentials flow for machine-to-machine communication
