As browsers move to limit third-party cookies and tracking, conventional federated identity flows which require third-party cookies can cause privacy and compatibility issues. FedCM (Federated Credential Management) addresses this by letting the browser mediate the communication between the Identity Provider (IdP) and the Relying Party (RP) so that federated sign-in can be performed without third-party cookies.
Enterprise IAM assumes whoever’s on the other end of a login is a human. AI agents break that assumption, not with some clever new attack, but by walking straight through shortcuts we’ve always taken: screen-level permissions instead of API-level ones, one consent prompt per app, identity lifecycles tied to HR events instead of agent lifecycles.
Whether you’re building a massive SaaS platform or a niche API, OAuth is the standard for authorization. But every OAuth setup runs into the same wall eventually: registration.
Every time a user clicks “Sign in with Google” or gets SSO access to a third-party app from a corporate IdP, identity crosses a trust boundary. Identity proofing happened somewhere, authentication happened somewhere else, and now another system needs to rely on that result.
