CoSAI Paper Sets Token-Exchange Standard for Agentic Trust Boundaries
What happened
The Coalition for Secure AI (CoSAI) published The Agentic IAM Paper, a technical governance paper released on April 29, 2026, outlining a control principle that has significant implications for enterprise authorization design: token exchange should occur at every trust boundary in an agentic workflow. The guidance covers both agent-to-tool and agent-to-agent handoffs, which are the points at which most enterprise credential controls currently break down. Rather than relying on long-lived or standing credentials that an agent carries across an entire task chain, the CoSAI model requires that access tokens be scoped and re-issued each time an agent crosses into a new operational context. This approach directly reduces the blast radius if a credential is compromised mid-workflow, because no single token grants persistent access across the full chain. The paper is part of a growing body of agentic security guidance that connects to concerns raised around AI agents mirroring OAuth attack chains, where existing enterprise authorization controls have been shown to be structurally inadequate for autonomous agent deployments.
Why it matters
- ·Most enterprise IAM programs were built around human-initiated sessions and do not require token re-issuance at internal system boundaries. Agentic workflows that carry standing credentials across tool calls create a single point of credential failure that traditional access controls cannot contain, expanding an organization's attack surface in ways that may not be visible to existing security monitoring.
- ·Regulatory frameworks increasingly treat authorization integrity as a baseline expectation for automated systems. The Financial Stability Board Recommendations on Agentic AI Controls in Financial Services and the Model AI Governance Framework for Agentic AI, Version 1.5 both signal that regulators expect scoped, auditable delegation chains. Enterprises that cannot demonstrate bounded credential issuance at each handoff may face compliance gaps as these expectations harden into enforceable requirements.
- ·The CoSAI guidance also reinforces the audit challenge: without discrete token issuance at each boundary, it becomes difficult to reconstruct exactly which agent acted on which authorization at what point in a workflow. This directly weakens the auditability of agentic decisions, a problem that connects to active exploitation patterns around agent OAuth chains and the broader issue of logging completeness in multi-agent systems.
Governance controls affected
What to do now
- ☐Audit all deployed agentic workflows to identify points where a single credential or token is passed across more than one tool or agent boundary without re-issuance.
- ☐Update agent credential isolation policies (AGT-007) to require scoped, short-lived token exchange at each trust boundary, aligned with the CoSAI principle.
- ☐Review OAuth scope configurations for all agent-connected tools and services to identify standing permissions that exceed the minimum required for each discrete task.
- ☐Incorporate trust-boundary token exchange requirements into your agentic AI deployment readiness assessment and pre-production approval gate before approving new agent integrations.
- ☐Verify that agent audit logs capture the specific token scope and authorization context at each boundary crossing, not just the final action taken, to support post-incident reconstruction.
What to watch next
The CoSAI paper arrives as multiple standards bodies and regulators are converging on agentic identity as a priority area. The ITU Focus Group on Trust and Identity for Humans and Agentic AI is expected to produce further guidance that may reference scoped delegation as a baseline requirement. Compliance teams should also monitor whether the CISA Agentic AI Guidance evolves to incorporate token-boundary requirements explicitly, particularly for operators of critical infrastructure or federal systems. Organizations in financial services should track whether FSB or prudential regulators translate this control principle into supervisory expectations during upcoming examination cycles.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.