The runtime layer for the identity your provider issues.
Your identity provider decides who your AI agents are and what token they carry. Watchlight AI Beacon decides whether each action that token attempts is allowed, and proves what happened.
Agent registration
the agent is a first-class identity, mapped to its human owner
Token issuance
an attenuated actor token, scoped to the task
sub = human · act = agent
scope = taskWho the agent is, and what token it may carry.
Verify the delegated authority
confirms the agent's action stays within the attenuated chain
Enforce before execution
Record signed execution lineage
the human → agent → action chain, as tamper-evident proof
← CAEP Runtime verdicts (quarantine, revoke) propagate back to your identity provider.
Your IdP owns who the agent is and what token it carries. Watchlight owns whether this specific action, under this specific delegated authority, is allowed, and the proof of what happened.
Watchlight already enforces delegated authority
The runtime governance an identity provider cannot do on its own, shipping now, independent of any specific IdP.
Enforce delegated authority at runtime
Watchlight already validates the human → agent → sub-agent chain on every action, and rejects any step that widens scope beyond what was delegated.
Deny out-of-scope actions before execution
A prompt-injected or out-of-scope attempt is denied before it runs, because the delegated authority never granted it.
Prove the delegation chain in action
The full human-to-action chain is recorded as signed, tamper-evident execution lineage the IdP does not capture.
Native connectors for your identity provider
Designed for where enterprise IAM is going, and built IdP-neutral so Okta, Ping, and any OIDC provider are clients of the same contract.
Agent provisioning (SCIM)
Sync agent identities and human-owner mapping from your IdP, and push discovered shadow agents back up so the directory reflects reality.
Actor-token verification
Verify the attenuated actor token (sub = human, act = agent) and its scope, anchored on RFC 8693 token exchange and the emerging OAuth agent-delegation profiles.
Continuous access evaluation (CAEP)
Propagate runtime verdicts back to the IdP, and cascade IdP risk signals to a person’s active agent runs, in both directions.
Anchored on the open standards enterprise IAM is converging on for agent delegation:
Identity says who. Watchlight says whether.
See how Watchlight AI Beacon enforces delegated authority at runtime and proves the chain in action.
Okta and Ping are trademarks of their respective owners, used for identification only. Watchlight AI is independent and IdP-neutral; references do not imply partnership or endorsement.