Every governance framework the identity community has built for AI agents answers the same question: should this agent be allowed to run? Registration policies, approval workflows, capability inventories - all of it evaluates the agent before it acts. And all of it shares the same blind spot.
OpenClaw made that blind spot visible overnight. Over 42,000 unprotected gateways. Plaintext credentials. No audit trail. But the real lesson of OpenClaw isn't that ungoverned agents are dangerous - we knew that. It's that governance at registration time can't help you at execution time. Even an agent that passed every onboarding check can chain tools in an unplanned sequence, act on stale delegated authority, or follow a prompt injection into a privilege escalation - all within policy, all within a single turn.
The missing layer isn't a new proprietary control plane. It's something the identity community already knows how to build: runtime authorization. Per-action policy evaluation at the moment an operation is attempted, and per-query control over what an agent can even discover. OpenID AuthZEN gives us the right primitives - evaluation APIs for real-time access decisions, search APIs for scoped discovery - applied to software actors that improvise. The patterns are familiar: PEP, PDP, obligations, evidence. The actor is new.
In this keynote, I'll demonstrate what runtime agent authorization looks like in practice: an agent stopped mid-action by policy and held until a human decides, a signed execution envelope that separates request from control, and an evidence chain that gives auditors cryptographic proof rather than reconstructed logs.
I'll also cover the tradeoffs honestly - where runtime evaluation adds latency, where it constrains autonomy, and why the answer isn't to authorize everything equally but to know which actions demand hard control and which can remain fluid.
If you're building with agents, securing them, or trying to move from guardrails to standards-based runtime control - this is the twenty minutes that reframes the question identity teams should be solving now.
