Okta-led alliance unveils blueprint for AI agent security

Okta and a group of technology companies have formed the Blueprint Alliance to develop a shared architecture for securing AI agents. The coalition spans identity, cloud, cybersecurity, data and software.

Founding members include AWS, CrowdStrike, Databricks, Docker, Google Cloud, Lovable, Okta, Proofpoint, Salesforce, ServiceNow, Wiz and Zscaler. Together, they have expanded an existing blueprint into an open reference architecture designed to help organisations govern AI agents used across business systems, data platforms, networks and infrastructure.

The move reflects growing concern over how companies control large numbers of software agents acting on behalf of staff, customers or partners. The alliance is built around four core questions for businesses deploying these systems: where agents are, what they can do, what they are doing and how organisations should respond when something goes wrong.

Under the proposed approach, every agent would be treated as a distinct identity, with access limited to specific tasks rather than broad, standing privileges. The architecture also calls for traceable delegation, continuous monitoring of runtime behaviour and the ability to contain or restore agents quickly if risks emerge.

Industry forecasts have added urgency to the debate. Gartner predicts that by 2028, the average global Fortune 500 company will have more than 150,000 agents in use, while only 13% of organisations believe they have the right governance for AI agents.

APJ focus

Dan Mountstephen, Senior Vice President and General Manager, APJ at Okta, said the issue is particularly acute in the region because of its complex mix of regulations and technology environments.

"In APJ's highly complex regulatory and multi-cloud ecosystem, securing the agentic workforce isn't something any single vendor can accomplish alone. By establishing a shared architecture alongside industry leaders, the Blueprint Alliance ensures APJ enterprises can answer the critical questions-where agents exist, what they access, and how they behave-enabling secure, compliant AI transformation at scale," Mountstephen said.

The architecture is intended to sit above work already under way on model security and supply chain integrity, focusing instead on the governance layer that applies once agents are deployed and interacting with internal and external systems.

That includes agent discovery and identity registration, security posture checks, access policy controls, governance reviews, runtime authorisation, downstream resource monitoring, response measures and staged recovery after an incident. These controls should be supported by telemetry, logging and observability data so risk signals can be shared across systems.

Advisory role

Two organisations outside the founding vendor group, GE Appliances and World Central Kitchen, are acting as strategic advisers. They are expected to help test whether the model can work in operational environments with very different demands, from manufacturing to disaster response.

"AI agents have the potential to transform manufacturing by accelerating problem-solving, improving quality and strengthening collaboration across the value chain. Unlocking that value at scale requires strong governance, clear visibility into where agents operate, what they can access and how they make decisions," said Mandar Deo, Chief Digital Technology Officer, GE Appliances.

"As a strategic advisor to the Blueprint Alliance, GE Appliances is bringing a real-world manufacturing perspective to help shape and validate a secure, scalable architecture that can operate across complex industrial environments-while maintaining accountability, trust and human controls," Deo said.

World Central Kitchen outlined a similar concern around control and oversight as it adopts more agentic tools.

"In order to support the urgent technology demands of disaster response on a global scale, World Central Kitchen is embracing the dynamic benefits of agentic technology," said Brian Stoll, Chief Technology Officer, World Central Kitchen.

"To do so responsibly requires establishing governance that is as dynamic as the agents themselves. We are looking forward to participating in the Blueprint Alliance for this exact reason: to help establish principles, processes, and tooling for agentic discovery, ownership, runtime control, and observability - not to mention a better night's rest for the CTO," Stoll said.

Interoperability goal

A central aim of the alliance is deeper interoperability between vendors whose products sit across different parts of the AI and security stack. Members are building and testing ways to share threat and activity signals using open standards including MCP, OCSF, SSF and CAEP, so an alert in one system can trigger action elsewhere.

The group also plans to publish reference integrations and interoperability results to help companies stitch together products from several suppliers rather than rely on one provider. That reflects the broader market reality that many large organisations run AI workloads across several clouds, applications and security tools at once.

For Okta and its partners, the challenge is not simply identifying AI agents but creating a common operating model around them.

"The blueprint started because our customers needed a consistent architecture for securing agents, one that governs identity, access, and execution across the entire stack without shutting down the autonomy that makes agents useful. Getting there required founding members across the Blueprint Alliance to align on a shared approach rather than each vendor solving it alone. We're glad to have contributed to that work, and we look forward to the industry building and testing against it as we help secure the future of AI," said Steven Tamm, Senior Vice President of Ecosystem, Okta.