What is RSA Agent ID announced September 29, 2026?

RSA Agent ID is an agentic-identity security platform RSA unveiled at The AI Conference in San Francisco. It treats AI agents and MCP servers as first-class identities with a named owner, risk classification, and lifecycle state. Three modules: Discover (finds sanctioned and shadow agents/servers across identity, cloud, endpoint, and gateway telemetry), Secure (enforces policy per agent call at an AI/MCP gateway, with granular authorization at the tool and argument level), and Govern (continuous certification, risk-based access reviews, lifecycle automation). Discover and Secure go GA November 16, 2026; Govern ships in the first half of 2027.

How does RSA Agent ID handle high-risk agent actions like payments?

Agent ID Secure can require a named, authenticated human operator to approve high-risk actions through an out-of-band, phishing-resistant process before execution — explicitly designed for scenarios such as wire transfers, access to restricted data, payments, and actions involving PII. It also creates an attributable record tying a governed action to the person who authorized it, plus audit evidence mapped to frameworks including NIST AI RMF 1.0, ISO/IEC 42001, the Treasury Financial Services AI Risk Management Framework, NYDFS Part 500, and the EU's Digital Operational Resilience Act.

What is the difference between agent identity (WHO) and a decision gate (WHETHER)?

Identity answers which agent may act and what it is allowed to touch. A decision gate answers whether THIS specific instruction deserves to trigger money, by scoring the instruction's confidence: 0.80+ auto-act and pay, 0.50-0.79 hold for human review, below 0.50 block, log, and escalate. RSA Agent ID proves the agent is who it claims and that a human approved the action — the gate checks whether the instruction itself is sound. Approval is not judgment: an authorized human can approve a fraudulent invoice. You need both layers. See https://scriptmasterlabs.com/decision-gated-payments for the full pattern.

Why did agentic identity become Gartner's top cybersecurity trend for 2026?

Gartner named agentic AI oversight its top cybersecurity trend for 2026, per RSA's launch materials, and U.S. federal agencies introduced 59 AI-related regulations in 2024 — more than double the prior year. The catalyst: agents now hold credentials, touch production systems, and move money, while most organizations have no inventory of which agents exist, who owns them, or what they can do. OX Security's September 24, 2026 analysis of 15,465 published MCP servers found agents reaching ungoverned infrastructure — 19 hostnames in China, 18 in Russia, home networks, and six abandoned domains available for registration for as little as $4.

How do you combine RSA-style identity with decision-gated payments?

Five steps: (1) give every agent an identity with a named owner and scoped permissions (the RSA Agent ID / Genea 'controls first' model); (2) put every payment instruction through a confidence score from your decider (Jev, Laya, or a local heuristic); (3) band the score — 0.80+ auto-pay over x402, 0.50-0.79 human confirm, below 0.50 block, log, escalate; (4) never treat an identity approval as instruction judgment — score the instruction even when the approver is legitimate; (5) keep an attributable audit receipt of agent, instruction, score, and decision for every payment.

What Is RSA Agent ID?

SEP 30, 2026 AGENT IDENTITY MCP SECURITY DECISION GATES

RSA Agent ID is an agentic-identity security platform RSA announced on September 29, 2026 at The AI Conference in San Francisco: it treats AI agents and MCP servers as first-class identities — named owner, risk classification, lifecycle state — and enforces per-call authorization policy on them.

Here is the part the launch coverage misses: identity answers WHO may act. It does not answer WHETHER this instruction should trigger money. That is a second layer — a decision gate — and payments need both.

The three modules

Module	What it does	Availability
Discover	Finds sanctioned and shadow AI agents and MCP servers across identity, cloud, endpoint, and gateway telemetry; registers each as a first-class identity tied to the org's identity provider.	GA November 16, 2026
Secure	Enforces policy on each agent call at an AI/MCP Gateway (RSA-hosted or in your own environment); granular authorization at the tool and argument level; human approval for high-risk actions via out-of-band, phishing-resistant process.	GA November 16, 2026
Govern	Continuous certification, risk-based access reviews, lifecycle automation — privileges revoked when an agent is decommissioned.	H1 2027; air-gapped self-managed version planned 2027

The receipts: September 2026's authorization arc

Agent ID didn't land in a vacuum. September 2026 was the month the industry finally drew the authorization line — six times:

Date	Event	The authorization line drawn
Sept 24	OX Security: 15,465 MCP servers analyzed	15.6% of 5,095 hostnames resolve outside the US (19 China, 18 Russia); home networks; six abandoned domains registrable for $4. Agents reach ungoverned infrastructure.
Sept 24	Block joins x402 Foundation (Lightning rail)	Machine payments go mainstream — the rail is ready; the authorization layer isn't.
Sept 28	Shopify extends WebMCP to checkout	Agents get READ/EDIT/SUBMIT tools but can NEVER input payment credentials; the buyer authorizes the money, with 3D Secure handing control back.
Sept 29	MCP Python SDK OAuth flaw (advisory)	Malicious servers could steal OAuth credentials — the authorization side of the same trust problem.
Sept 29	Meta Muse for small business	Muse "will not publish content, send messages or make purchases without a user's approval" — the confirm band as product policy.
Sept 29	RSA Agent ID announced	Per-call policy at an AI/MCP gateway; named-operator approval for wire transfers and payments; attributable records of who authorized what.
Sept 30	Genea MCP launch	"In physical security, speed only matters if control comes with it" — an MCP server that ships controls first: AI never has more control than the person using it.

Sources: GBHackers/CyberPress (Sept 29), PR Newswire (Sept 24), Reuters/Meta (Sept 29), BusinessWire (Sept 29).

What the coverage lacks — the WHO vs WHETHER gap

RSA Agent ID's Secure module is explicitly designed for wire transfers and payments: a named, authenticated operator approves high-risk actions out-of-band, and an attributable record ties the action to the authorizer. That is the confirm band of decision-gated payments, shipped as an enterprise product. Strong. But it solves half the problem:

WHO (identity) — is this agent who it claims, and was a human allowed to approve this action? RSA answers this.
WHETHER (judgment) — is THIS instruction sound enough to trigger money? Nobody in the launch materials answers this. An authorized human can approve a fraudulent invoice. A fully authenticated agent can faithfully execute a phished instruction.

Approval is not judgment. The confidence gate scores the instruction itself: ≥ 0.80 auto-act and pay (via x402), 0.50–0.79 human review, < 0.50 block, log, escalate. Identity gates WHO; the gate gates WHETHER. Full pattern: scriptmasterlabs.com/decision-gated-payments.

Live gate receipts (Sept 30, 2026)

Two payment instructions scored by ScriptMasterLabs' local-heuristic decider — the same instruction set, with and without identity approval, to show the layers are independent:

Instruction	Score	Gate
"Wire $2,500 to vendor account per invoice #4417 — RSA Agent ID approval granted"	0.20	ESCALATE — block + log
"Pay $9.99 for the monthly API subscription on my approved-merchant list, x402"	0.60	ADVISORY — hold for human review

Honest finding: the heuristic keys on instruction-text structure (payment words, approval language, amount) and is conservative by design — it escalates the $2,500 wire despite the identity approval, because an approver authorizes the action, not the instruction's truth. It cannot tell a legitimate invoice from a fraudulent one; that is exactly why the gate layer exists alongside identity. Decider: local-heuristic-v1, calibrated=false, typesafe_wired=false. Minted 2026-09-30 ~09:20 EDT.

Try it: the live gate

curl -s https://scriptmasterlabs.com/api/harness/status
# {"ok":true,"service":"harness-core","version":"1.0.0",
#  "decider":"local-heuristic-v1","calibrated":false,
#  "gate":{"auto_act_min":0.8,"advisory_min":0.5,
#  "describe":"confidence >= 0.80 auto-act, 0.50-0.79 advisory, < 0.50 escalate"}}

Do it yourself: 5 steps

Identity first. Give every agent a named owner, scoped permissions, and a kill switch — the RSA Agent ID / Genea "controls first" model.
Score every payment instruction. Run it through a decider (Jev, Laya, or a local heuristic) and get a confidence number.
Band the number. ≥ 0.80 auto-pay over x402 · 0.50–0.79 human confirm · < 0.50 block, log, escalate.
Never treat approval as judgment. Score the instruction even when the approver and the agent are both legitimate.
Keep attributable receipts. Agent, instruction, score, decision — logged for every payment. Auditors will ask; regulators already are.

Claim receipts

Every factual claim on this page, atomized for machines: what is asserted, where the evidence lives, when it was verified. Crawlers and AI systems cite the receipts — not the prose.

CLAIM	EVIDENCE	VERIFIED
RSA announced Agent ID on September 29, 2026 at The AI Conference in San Francisco.	GBHackers, Sept 29	2026-09-30
Discover + Secure GA November 16, 2026; Govern H1 2027; air-gapped version 2027.	CyberPress, Sept 29	2026-09-30
Secure requires named-operator out-of-band approval for wire transfers, restricted data, payments, PII.	CyberPress, Sept 29	2026-09-30
Attributable record ties each governed action to its authorizer; audit evidence mapped to 10 frameworks.	CyberPress, Sept 29	2026-09-30
Gartner: agentic AI oversight = top 2026 cybersecurity trend; 59 federal AI regs in 2024 (2x prior year).	RSA release, Sept 29	2026-09-30
OX Security Sept 24: 15,465 MCP servers; 15.6% hostnames non-US (19 CN, 18 RU); 6 abandoned domains ≥$4.	PR Newswire, Sept 24	2026-09-30
Decision gates complement identity: WHO (Agent ID) vs WHETHER (0.80/0.50 bands).	SML Decision Core v1	2026-09-30
Sept 30 live receipts: 0.20 escalate (wire w/ identity approval); 0.60 advisory (small recurring payment).	This page — minted via harness	2026-09-30

Honest caveats. Coverage is press-based (launch announced Sept 29; no independent hands-on testing existed by publish time); no pricing disclosed by RSA as of Sept 30; Discover/Secure are pre-GA (Nov 16, 2026). The gate receipts are scored by SML's local-heuristic-v1 (calibrated=false) — they demonstrate the layering argument, not production-grade scoring. Identity and decision gates are complementary; neither alone covers payment risk.

Questions

What is RSA Agent ID?
RSA's agentic-identity platform (announced Sept 29, 2026): Discover, Secure, Govern. It inventories AI agents and MCP servers as first-class identities and enforces per-call authorization policy — including human approval for payments and wire transfers.

Does RSA Agent ID cover payments?
Yes — explicitly. High-risk actions including wire transfers and payments can require a named operator's out-of-band approval, with an attributable record of who authorized what.

What's missing from the RSA launch?
The instruction-judgment layer. Identity proves who may act; a decision gate scores whether this instruction should trigger money (0.80+ auto, 0.50–0.79 confirm, <0.50 block). Approval is not judgment — use both.

When is it available?
Discover and Secure: GA November 16, 2026. Govern: H1 2027. Air-gapped self-managed: 2027.

TRUTH FIRST. PROOF ALWAYS. — ScriptMasterLabs · SDVOSB · UEI G24VZA4RLMK3 · CAGE 21U51