{"topic":"oauth","title":"oauth","url":"https://theexchange.tech/archive/oauth","description":"Dispatches on oauth for AI agents in financial services.","questions":[],"count":1,"startHere":[],"articles":[{"title":"NIST's agent-identity build starts in a software factory. The advisor-to-custodian hop isn't on its schedule.","url":"https://theexchange.tech/articles/nists-agent-identity-build-starts-in-a-software-factory-the-advisor-to-custodian-hop-isnt-on-its-schedule","json":"https://theexchange.tech/articles/nists-agent-identity-build-starts-in-a-software-factory-the-advisor-to-custodian-hop-isnt-on-its-schedule.json","excerpt":"NIST's NCCoE has summarized 614 comments on agent identity and authorization. Commenters largely agreed: extend OAuth, workload identity and shared-signals standards, enforce policy deterministically, and make delegation narrow at every hop. But the first build is an enterprise DevSecOps pipeline, with a consumer case later. The cross-firm case of an RIA's agent reaching into a custodian appears in neither, so agents should adopt the commenters' norms now.","publishDate":"2026-10-19","author":"Nadia Osei","topics":["agent-identity","nist","delegated-authority","standards","governance","custodians","oauth"]}]}