On April 28, 2026, the FIDO Alliance announced an Agentic Authentication Technical Working Group. The charter is one of the more consequential pieces of standards work in the AI agent space this year, and it deserves more attention than it has received from the governance community.
This post covers what the TWG is solving, what it deliberately does not solve, and why authentication and runtime enforcement are complementary layers in the stack an enterprise needs to deploy autonomous agents safely.
What the TWG is solving
The problem the FIDO Alliance has decided to take on is, in plain terms, how an AI agent proves it has the right to act on a user's behalf when it touches a web service. Today, the answer is one of two unsatisfying options. Either the agent has the user's full credentials and acts as if it were the user, which is indistinguishable from credential theft from the service's perspective. Or the agent uses a brittle screen-scraping or browser-automation layer that breaks every time a login page changes and that no security team would knowingly approve.
Neither path scales to the volume of agent activity that current product roadmaps assume. If an agent is going to book travel, manage a calendar, place orders, file expense reports, and triage tickets across a dozen SaaS tools, the authentication layer has to be designed for an agent, not retrofitted from a human login flow.
The TWG charter, as described in the announcement, focuses on three problems in particular. First, phishing-resistant authorization of agents, building on the same cryptographic primitives that have made passkeys work for humans — users authorize agents without exposing credentials. Second, user-delegated scoped authority, so a person can grant an agent a narrow, time-bound, revocable permission to act on a specific surface rather than handing over a master credential. Third, agent-initiated commerce, where an agent transacts on behalf of a user within user-controlled boundaries and the merchant can verify both the user's intent and the agent's authority without a synchronous human-in-the-loop step.
The group's leadership signals how seriously the industry is taking this: chairs from CVS Health, Google, and OpenAI, with payments and identity heavyweights among the contributors. If the TWG gets these three problems right, a great deal of the credential-handling pain that currently blocks agent deployment in regulated environments will go away.
What the TWG is not solving
A FIDO standard tells a service that the entity logging in is who it claims to be, and that it has been delegated specific authority by a specific user. That is a meaningful primitive, and a hard one to build well. It is also not the same problem as governing what the agent then does once it is inside the service.
Consider an authenticated agent acting on behalf of a procurement manager. FIDO-style delegation can confirm that this agent has scoped authority to place orders up to a stated limit on a stated set of vendors. It will not tell you whether the agent is about to exfiltrate vendor pricing data to a third-party AI service in the same session. It will not tell you whether the prompt that drove this action was injected by a malicious document the agent ingested two steps earlier in the chain. It will not tell you whether the agent's next tool call is about to violate an internal policy the procurement team has never written down in machine-readable form.
These are action-enforcement problems, not authentication problems. They concern what the agent does, what data flows through it, and what actions it takes, in the moment, against the policies the organization actually cares about. Authentication is necessary. It is not sufficient.
This is not a criticism of FIDO. Standards bodies are most useful when they pick a narrow, tractable problem and solve it well. The TWG is doing exactly that. The point is that enterprises planning to deploy agents in 2026 and 2027 should be clear about which problem each layer of the stack is solving, and where the gaps are.
How the two layers fit together
Think of it as the same separation that already exists for human users. SSO and MFA tell a SaaS application who the user is and that the user has authenticated strongly. DLP, CASB, and governance tooling tell the security team what the user is doing once they are inside the application, and whether that activity is in line with policy. Both layers are required. Neither replaces the other.
For agents, the analogous picture is FIDO-style agentic authentication providing the strong delegation and identity layer, and an enforcement layer ruling on the agent's actual actions at the point where they become irreversible. The authentication layer answers "should this agent be allowed in?" The enforcement layer answers "given that it is in, should the action it is about to take execute?"
We work on the second layer — Containment.ai builds AI Action Enforcement, the independent enforcement layer for AI-powered systems. We are watching the FIDO TWG closely because the better the first layer becomes, the more value the second layer can deliver. An agent that arrives at an enforcement point with a cryptographically verifiable, scoped delegation token is an agent a policy engine can reason about with much greater precision: which user it is acting for, what authority it has been granted, and where the boundary of that authority sits. That context lets an enforcement layer make sharper, less noisy authorization decisions — deterministically, before the action executes.
The same layering matters even more in national security, defense tech, and aerospace and defense environments, where the entity behind an action and the authority for that action must both be provable after the fact. Strong delegation plus action-time enforcement is the shape of an assurance case; either one alone is not.
What enterprises should do now
If you are planning agent deployments for late 2026 and into 2027, three things are worth doing this quarter.
First, follow the FIDO TWG's work. The membership and timeline matter. If your identity provider, your major SaaS vendors, and your browser of choice are all engaged, the path to production is much shorter than if they are not. The TWG's deliverables will shape how every downstream agent platform handles delegation, and you want to be a fast follower rather than a late one.
Second, write down what your agents are allowed to do, in plain language, before you start writing policy in any specific tool. Most of the enforcement work that is hard in 2026 is hard because organizations have not articulated their internal policies in a form that can be enforced. The authentication layer cannot help you here. Neither can we. The work of stating "an agent acting for a procurement manager may not exfiltrate vendor pricing to a third-party AI service" is a human exercise that has to happen first.
Third, treat authentication and enforcement as two procurement conversations, not one. The vendors who will solve agentic authentication are not the vendors who will solve action-time enforcement, and a single-vendor stack mediocre at both is the wrong outcome. Pick the best layer for each problem.
Where we stand
Containment.ai is an AI Action Enforcement company. We are not part of the FIDO Alliance TWG and have no commercial stake in how it resolves. We are an enthusiastic observer because the TWG is solving a real problem that has been making agent deployment harder, and because the cleaner the authentication layer becomes, the better the enforcement layer can do its job.
The infrastructure for safe, governed agent deployment is genuinely being built in 2026, in public, by serious people. It is worth paying attention.