Identity Federation Between IdP and HRIS for Agent Pipelines
AI agents need their own scoped identities tied to the HRIS source of truth.
Identity federation between an HRIS and an IdP was built to answer one question: does this person still work here, and what are they allowed to touch? Agent pipelines now ask that same chain to answer a harder question it was never designed for: whether a piece of software acting on someone's behalf should inherit the same answer. Most vendors are answering it by bolting on a separate credential system for agents, and that's the wrong call. The HRIS has to stay the one authoritative source of truth, with its signals moving cleanly through the IdP before any agent gets a credential of its own.
The HRIS-to-IdP federation chain for human identities, the baseline every agent pipeline inherits
The joiner-mover-leaver model, JML for short, is the backbone of identity operations everywhere. Someone gets hired, so they're onboarded. They change roles, so their access changes with them. They leave, and every downstream system needs to know it, fast. The whole model runs on HR-driven state changes propagating outward, and it works precisely because there's one clock everyone agrees to check.
SCIM 2.0 is what makes that propagation possible without an IT ticket for every new hire. It gives the IdP a common schema and API for creating, updating, and deleting accounts across every connected app, so an HR event turns into a provisioning action automatically rather than something a helpdesk technician does by hand on a Friday afternoon.
How that connection actually gets built differs by platform, and the differences matter for anyone wiring this up. Workday uses Web Services alongside a RaaS pull model. SAP SuccessFactors runs SCIM through its Identity Provisioning Service, plus event-driven notifications via Intelligent Services. BambooHR offers SCIM 2.0 over REST with webhooks. ADP doesn't provide SCIM support natively out of the box, so most shops bridge it through a third party to get provisioning behavior similar to SCIM out of a REST API. UKG and Oracle Cloud HCM both land on SCIM over REST, though UKG Pro has to fall back on polling since it lacks native webhooks, while Oracle's SCIM REST API supports push.
Okta's Workforce Identity Cloud shows what this looks like once it's running end to end. Its connectors to Workday, BambooHR, and SuccessFactors kick off onboarding automatically: account creation in every downstream app, license assignment, a welcome email with credential setup, all triggered off one HR event. Offboarding runs the same way in reverse. One HR trigger, and every app the person touched loses access within minutes. That speed, and that single point of control, is what agent pipelines need to borrow. Most of them don't have it yet.
The human JML model's breakdown when agents enter the picture
Non-human identities don't have a hire date. They come from software lifecycle events rather than HR events, such as a deployment, a container spinning up, a pipeline kicking off, or an agent getting invoked mid-workflow. None of that maps to a start date or a manager field in Workday, because Workday was never built to describe it.
Human identity governance assumes employment as the anchor. Someone joins, someone moves teams, someone eventually leaves, and the access model tracks that arc from start to finish. Non-human identities have no arc at all, and most identity governance and administration platforms were built without that distinction in mind.
The scale of the mismatch is what makes it urgent, not some hypothetical edge case. Palo Alto Networks' 2026 Identity Security Landscape put the machine-to-human identity ratio at 109 to 1 across a sample of 2,930 organizations, up from 82 to 1 the year before. Separately, 80% of IT leaders report that agents have acted outside expected behavior, according to Strata Identity. That's a control plane failing to keep pace with the workload it's supposed to govern. With 60% of enterprises expected to have AI agents in production within a year as of 2025, organizations need to plan for this now. It's already running in production, and nobody gets the luxury of planning around it at leisure.
The emerging architecture for anchoring agent identity to the HRIS-IdP chain
When an agent acts on behalf of a person, it should get a scoped, lifecycle-aware slice of that person's entitlements. Anything else just recreates shadow IT with better branding. The HRIS-to-IdP chain has to be the source of those entitlements, since a side channel drifts out of sync the moment the person's role changes.
Microsoft's approach with Entra Agent ID integrates with both the ServiceNow AI Platform and Workday's Agent System of Record, so agents built in either platform get automated identity provisioning instead of manual setup. It now integrates with both the ServiceNow AI Platform and Workday's Agent System of Record, so agents built in either platform get automated identity provisioning instead of manual setup. Every agent created in ServiceNow or Workday ends up with its own identity inside Entra.
Structurally, the goal is that each agent gets its own scoped identity rather than borrowing or inheriting the human's credentials directly, with federated credentials issued to the agent identity as needed rather than passed through from the person.
Agent identity should trace back through the human identity chain: HRIS to IdP to a scoped token. Anything that sits off to the side as its own unmoored credential is a liability waiting for an audit to find it.
Token delegation protocols that carry HRIS-derived context through an agent pipeline
Agent authentication is a stack, and each layer answers a different question. User delegation comes first: is this agent really acting for this specific person? That's handled by OAuth 2.1's authorization code flow with PKCE. On-behalf-of propagation comes second: as that delegation moves through calls to other services and other agents, does it stay intact? That's OAuth Token Exchange, RFC 8693. Workload identity comes third: independent of any human, is this specific agent instance actually who it claims to be? That's the job of SPIFFE/SPIRE, OIDC workload identity federation, or the newer WIMSE effort.
RFC 8693 is the backbone of the delegation layer. A client sends a subject_token, the party the request is really on behalf of, ultimately traceable back to a real person sitting in the HRIS, and an actor_token, the agent that's been handed delegated rights. The authorization server takes both and issues a narrower token, scoped down to whatever the downstream operation actually needs.
RFC 8693 is most often paired with JWT bearer grants under RFC 7523, so every service the request touches can still answer who the human was, what they authorized, and which other services were involved along the way. The HRIS-derived context doesn't evaporate at the first hop. It rides along, hop after hop, as long as nobody breaks the chain.
Google and Okta both added support for RFC 8693 Token Exchange in their 2024 to 2025 releases, giving enterprise IdPs a working baseline for delegation, even if implementation profiles vary. Community and open-source OAuth servers are still catching up, and that gap is exactly where a lot of mid-size shops are going to get burned.
Multi-hop delegation and the token security problems that compound across agent chains
Once an orchestrator agent calls a subagent, neither side of that call is a person. The human's delegation context has to survive the hop without picking up more scope than it started with, and getting this wrong is easy in ways that surface only during an incident review.
Two patterns are handling this today. Delegated sub-tokens are one: the orchestrator exchanges its own token via RFC 8693 for a narrower one, scoped specifically to whatever domain the subagent operates in, so the subagent gets only what the orchestrator explicitly hands down, not the full set of entitlements the original human had. Mutual TLS paired with SPIFFE is the other: subagents authenticate to each other through mTLS, using certificates rooted in a shared SPIFFE trust domain, while an authorization policy engine like OPA decides what one agent is allowed to do to another.
Both patterns share the same exposed nerve. Every hop in a multi-agent chain mints a new bearer token, and any one of those tokens can be pulled out through prompt injection or a side channel in a tool call. Active standards work in the IETF is aimed directly at that failure mode, exploring ways to bind tokens to the specific connection they were issued on so a stolen token cannot be replayed elsewhere. Multi-hop agent delegation is a primary motivator for that effort, and it is already shaping the design constraints under discussion.
The gaps in standards and tooling that the HRIS chain cannot yet fill
SCIM has a divergence problem even before agents enter the picture. Vendors interpret the spec differently, attribute names don't line up across platforms, and normalizing schemas across systems takes real integration work in an admin console, usually done by whoever drew the short straw that sprint. Pushing agent-relevant metadata through that same fragile SCIM layer only widens the cracks.
The deeper gap: no HRIS has a native concept of an agent. Workday, SuccessFactors, BambooHR, all of them model employees and contractors, not software acting for those employees. Workday's Agent System of Record, now tied into Microsoft Entra Agent ID, is an early attempt to close that gap, and it's generally available today, but it hasn't matured into anything close to a standard yet.
The agent lifecycle doesn't map onto JML, full stop. Agents get created by a deployment event. They scale horizontally in a way no employee roster does. Some exist for the length of a single pipeline run and vanish afterward; others persist indefinitely. None of those states have a clean field in an HRIS data model, because HR systems were never asked to describe them.
Protocol fragmentation compounds all of it. RFC 8693 is well supported across enterprise IdPs but isn't everywhere. SPIFFE/SPIRE has strong footing in cloud-native environments but little traction on mainframes or in the legacy estates that still run a lot of enterprise workloads. WIMSE is still taking shape as a standard rather than a finished one. Any organization running a mix of cloud-native and legacy systems can't assume one delegation protocol covers every hop from agent to resource, and assuming otherwise leaves gaps that a security review later flags.
Practical steps for wiring HRIS signals into an agent identity architecture that is lifecycle-aware
Fix the human chain first, before touching anything agent-related. Before any agent identity depends on HRIS-to-IdP propagation, that propagation needs to be clean and tested for every JML event, including the mover case, where selective revocation (pulling access to the old role while granting access to the new one) is where a lot of these pipelines quietly fail. A broken human chain hands agents broken context, and there's no patching that downstream. None.
Make the IdP the single point of federation authority. Cloud-native IAM tools like AWS IAM Identity Center, Azure Entra ID, and Google Cloud Identity should consume identity from the IdP rather than maintain their own separate pools of agent credentials off to the side. That's the prerequisite for HRIS-derived scope to actually reach the agent instead of stopping dead at the IdP boundary.
Pick an agent identity sponsorship model on purpose, not by default. For agents acting on behalf of one specific person, use OAuth 2.1 with RFC 8693 token exchange, anchored to that person's IdP session, so the agent's token carries the human's HRIS-derived scope and nothing wider than it. For agents with no human principal behind them, infrastructure automation, pipeline agents running on their own, use SPIFFE/SPIRE SVIDs for workload identity, with OPA policy mapping workload attributes to something like a role in the HRIS model.
Treat SCIM schema normalization as work that happens before any of this, not alongside it. Document the attribute mappings between HRIS fields and IdP schema now. Every gap left unmapped today is a gap an agent inherits later, usually at the worst possible moment, in the middle of an incident nobody saw coming.
