Here's the whole idea in one sentence: your AI agent is an account, so give it its own identity — a short-lived, narrowly scoped token — instead of handing it your API key. That account is called a non-human identity (NHI), and as of late July it's a category serious enough that a data-security company paid a billion dollars to own it.
If you've wired an agent into anything real — Stripe, GitHub, a production database, a pile of MCP servers — you've already created non-human identities, whether you named them or not. The only question is whether they're identities you can scope, watch, and revoke, or a single long-lived key copied into a dozen configs. This piece is the second option's exit ramp.
What just happened#
On July 28, 2026, Cyera signed a letter of intent to acquire Oasis Security for $1 billion — mostly cash, some stock. Oasis, founded in 2022 and backed by roughly $195M from Accel, Craft Ventures, and others, builds exactly one thing: security for non-human and AI-agent identities. Cyera isn't a small buyer reaching; it recently closed $600M at a $12B valuation, and it's folding Oasis in as its identity arm.
The signal for builders isn't the price. It's what got bought. A year ago "non-human identity" was a niche security-vendor phrase. Now it's a billion-dollar line item, because the number of automated actors holding credentials — CI jobs, service accounts, and above all AI agents — has blown past the number of humans, and none of the human controls fit them.
Why your human security doesn't cover your agent#
The controls you trust for people assume a person: a password, a phone for MFA, a login that happens during working hours from a familiar place. An agent has none of that. It can't approve a push notification. It runs at 3am. It acts thousands of times unattended. Behavioral anomaly detection tuned to "logins from a new country" is meaningless for a thing that has no country.
So an agent handed your credentials is the worst of both worlds: it has your full permissions, it can't prove it's the one using them, and when something goes wrong the audit log says you did it. Prompt injection makes this concrete — an agent talked into misusing a tool is misusing your access, at your privilege level, with your name on the record.
The mental model that fixes this: an agent is not you, and it is not a fixed backend service either. It's a third identity class — an actor that acts on your behalf, and its credentials should say exactly that.
The five moves#
You don't need a $1B platform to get most of the protection. Do these in order.
1. Give every agent its own identity — never your personal key. One identity per agent (or per agent role), cataloged with an owner and a purpose. The moment an agent authenticates as itself instead of as you, everything below becomes possible: scoping, attribution, revocation. This is the move that unlocks the rest.
2. Kill standing secrets. A long-lived API key is a bearer of your full permissions with no expiry — the single worst thing to hand an autonomous process. Replace it with short-lived, narrowly scoped tokens: the agent requests the minimum capability its task needs, gets a token that expires in minutes, and re-requests when it needs more. A leaked short-lived token is a non-event by morning. A leaked static key is a breach that outlives the project.
3. Delegate, don't impersonate. The token should carry two facts: who is acting and on whose behalf. In OAuth terms that's a claim shaped like sub=agent, act=human — the agent proves it's the agent, and the token records that a specific person authorized this scope. Now the API you're calling can audit the agent's actions separately from yours, and you can kill the agent without touching your own login.
4. If you run an MCP server on the internet, put real auth in front of it. The Model Context Protocol authorization spec is built on OAuth 2.1 and requires PKCE, HTTPS on every endpoint, and — critically — separating the token issuer from the MCP server itself, so the agent proves identity with short-lived scoped credentials instead of a permanent secret baked into a config file. The uncomfortable reality reported across 2026 security research is that most public MCP servers still ship with weak auth or none at all, and a large share leak credentials straight from hard-coded config values. Meeting the spec isn't just compliance here — it's the difference between your server and the majority that are one scan away from trouble. We walked the mechanics in MCP Authorization Explained: OAuth 2.1, Resource Indicators, and the Confused Deputy.
5. Log the agent as its own actor, and make revocation one click. Because the agent has its own identity and delegated tokens, your logs can attribute every action to it distinctly — and when it misbehaves, you revoke its credentials in isolation. A secrets manager (or workload identity federation, if you're on cloud infra that offers it) replaces the hard-coded key with something issued, rotated, and killable centrally. The test: can you cut one agent off in under a minute without rotating everything else? If not, you have a standing-secret problem hiding as an agent.
What it means for a solo founder#
The instinct when you read "$1 billion identity acquisition" is to assume this is an enterprise concern with an enterprise price tag. It isn't — the exposure just scales down. One founder with one agent touching Stripe, GitHub, and a database has the same shape of risk as a bank with ten thousand agents, minus three zeros.
And the fix scales down cleanly. You don't need Oasis or Cyera to do moves one through four: one identity per agent, short-lived scoped tokens, a secrets manager instead of copy-pasted keys, and OAuth 2.1 on anything you expose. That's a weekend of plumbing, not a procurement cycle. The billion-dollar deal is simply the market confirming that this plumbing is now load-bearing — the same "demo works, production is a different animal" gap that's minting funded companies, pointed at credentials.
The agents are already in your stack. This week's founder's wire is a running list of new ones to adopt. Every one you add is another non-human identity. The cheap version of this lesson is deciding, now, that none of them get to be you.
