ID-JAG, Transaction Tokens, WIF: The Three Layers of AI Agent Auth (opens in new tab)

Introduction Something clicked when I looked at the Workload Identity Federation that Anthropic shipped in May 2026. Delete the sk-ant-... API key, have a k8s service account JWT mint a short-lived sk-ant-oat01-... token, call anthropic.Anthropic() with no arguments, and it just works. The security posture clearly went up. But the actual day-to-day flow, where an agent "runs Cursor on Alice's GitHub PAT and opens a PR," did not change one bit. Cursor, Claude Code, Comet: all of them ultimatel...