Agent Identity and Authentication

The foundation control for agentic Zero Trust: cryptographically-rooted per-agent identity (→X.509→hardware attestation), short-lived IdP-issued tokens replacing static API keys (→mTLS→hardware-bound credentials), JIT access and ABAC — with MCP spec 2026-07-28 as the first shipping-protocol datum: issuer-keyed non-reusable client credentials as a MUST, RFC 9207 `iss` validation before code redemption, and OAuth Dynamic Client Registration deprecated in favor of Client ID Metadata Documents