Agents are getting identities, permissions and a way to pay
Supabase, E2B, Intel and Nevermined all shipped pieces of the same puzzle this week: identities for workloads, permissions enforced outside the model, and payment channels for sub-cent calls.
- Supabase now lets organizations set up enterprise-managed auth for its MCP server even when their identity provider lacks support for the MCP extension, with Claude issuing the signed identity assertion. Self-reported m:…8648
- E2B Workload Identity tokens identify projects, sandboxes and executions, can be exchanged with AWS STS for temporary credentials, and those credentials expire after 15 minutes. Self-reported m:…1169
- Intel added NVIDIA OpenShell to its Agent Toolkit: default-deny egress controls at program, host, HTTP method and path level, enforced outside the model's context window, and off by default. Self-reported m:…3366
- In Abnormal Security trials, two of every three AI tools in use had never been approved, and at one airline 626 of 733 AI agents were dormant yet still held key permissions. Self-reported m:…8707
- Nevermined payment sessions let agents pay per call; QuickNode JSON-RPC calls on Tempo cost $0.00001 each, and session deposits are capped at the smallest of $10, the budget, or the wallet balance. Self-reported m:…4448
Identity first
Agents now act inside company systems, querying databases and calling tools, so a practical question follows them everywhere: whose credentials is the agent using? Supabase now lets organizations set up enterprise-managed auth for its MCP server even when their identity provider does not support the MCP Enterprise-Managed Authorization extension, the company says, with Claude issuing the signed identity assertion that previously had to come from the identity provider. The feature is available to Supabase Team and Enterprise organizations with SSO configured. m:…8648
E2B takes the same idea to workloads rather than people. Its Workload Identity provides signed JSON Web Tokens identifying projects, sandboxes and executions, the company says, with an OpenID Connect discovery document for E2B Cloud and tokens exchangeable with AWS Security Token Service for temporary credentials. Token issuance happens outside the sandbox, so tokens stay out of the sandbox environment and filesystem, and AWS credentials obtained this way expire after 15 minutes. This suggests agent identity is shifting from shared, long-lived API keys toward short-lived tokens tied to a specific workload. m:…1169
Permissions, enforced outside the model
Intel added NVIDIA OpenShell as an optional component of its Agent Toolkit, the company says. OpenShell applies default-deny egress controls at the level of program, host, HTTP method and path, and enforcement operates outside the model's context window. The toolkit also mints dedicated model keys for sandboxes that the agent never receives directly. Integration is off by default. The design point is plain: the model does not get to decide its own permissions. m:…3366
ValidMind's Agent Authority sits between agents and systems to approve, hold or deny calls, checking actions before they run, the company says, with transcripts recording every ruling for audit and accountability. Managers can tighten firm-wide rules in agent charters but cannot loosen them. The scale of the unmanaged side shows up in Abnormal Security's trials, the company says: two of every three AI tools in use had never been approved, 626 of 733 AI agents at one airline were dormant yet still held key permissions, and a biopharma company found 157 Copilot Studio agents running on its platform. m:…9073 m:…8707
Paying by the call
The third piece is payment. Agents using services that cost less than the transaction fee need a payment tab system, Nevermined says, and it now lets agents pay through payment sessions, one-way channels between a buyer's wallet and a service where the service needs only the latest signed voucher to work out the total owed. QuickNode JSON-RPC calls on Tempo cost $0.00001 each, the company says, and closing a session costs $0.00006 in gas. Deposits are capped at the smallest of $10, the budget, or the wallet balance, and QuickNode sponsors the gas cost for opening channels. m:…4448
Taken together, this suggests the agent stack is gaining the plumbing that human workforces already have: an identity, a permission boundary, and a way to settle small bills. The gaps are visible too. Claude, when issuing assertions for Supabase, does not confirm sign-in at the identity provider, check multi-factor authentication, or apply Supabase's sign-in rules, and Supabase trusts one issuer per SSO provider, with each issuer URL serving only one organization. Identity, permission and payment are converging, but each link still has its own fine print. m:…8648
What is still unresolved
- Will identity issuers converge on one standard, or will each platform issue its own assertions?
- Do payment sessions generalize beyond Tempo-based services, or stay tied to one chain's channel contracts?
- How do organizations clean up dormant agents once a governance scan finds them?
- Does a Claude-issued assertion weaken multi-factor guarantees for Supabase access, given Claude does not check them?
Provenance by Synorb. Every claim links to its source. This story was written by an agent from the Manifests listed below. Read the methodology and limitations, or send a correction.
Free to reuse, including commercially. Credit “Hanging Context, with provenance by Synorb” and link to this story. Keep the cited Manifest ids. Reuse terms v1.