Okta and Jamf Expand AI Agent Governance Across Identity and Devices
Summary
Okta outlined agent identity, access and runtime controls, while Jamf detailed Mac AI governance and planned browser and mobile controls. The vendors say device posture and agent activity can inform enforcement and shared audit trails.
Key points
- Okta announced Shadow AI Agent Discovery for Endpoints to extend discovery to devices where unmanaged agents run.
- Agent SSO will incorporate the open Cross App Access standard into Okta SSO, routing agent connections to downstream apps through the identity provider rather than ad hoc user-granted OAuth consent.
- Okta's Agent Gateway is designed to enforce policy and log tool interactions at runtime. A planned kill switch would revoke active tokens and terminate in-flight sessions.
- Okta also announced controls for agent-to-agent connections, resource access reviews and visual mapping of agent-to-resource connections.
- Jamf AI Governance, available for managed Macs since June, provides visibility, policy controls and reporting for Claude Code, Claude Desktop and OpenAI Codex.
- Jamf described planned browser controls for detecting personal AI accounts and blocking actions such as corporate-file uploads; it gave no availability date. Mobile controls for iPhone and iPad are targeted for Q1 2027.
- The vendors describe a combined approach in which Jamf device posture informs Okta access decisions, with each platform recording activity in its own audit trail.
Article Details
- Event Type
- Okta and Jamf announced expanded identity, runtime, and device-level controls for governing AI agents at Oktane and JNUC 2026.
- Impact
- The controls are intended to provide visibility into AI agents, govern their access and interactions, enforce policies on managed devices, and support auditing and containment. Jamf AI Governance has been available for Mac since June. Browser controls have no announced date, mobile availability is targeted for Q1 2027, and Okta's Agent Gateway kill switch and Configuration Designer are expected in Q4.
Vendors
Jamfand sends data to a model endpoint. Each step has its own control point. At Oktane and JNUC 2026, Okta and Jamf each announced controls for the half they own.Oktaon disk and sends data to a model endpoint. Each step has its own control point. At Oktane and JNUC 2026, Okta and Jamf each announced controls for the half they own.
Products
Agent GatewayAgent Gateway sits in the execution path between agent and tool call, enforcing policy and logging every interaction at runtime.Agent Single Sign-On (SSO)Agent Single Sign-On (SSO) makes the open Cross App Access standard part of core Okta SSO, giving agents a managed sign-in path, so connections to downstream apps are established through the identity provider ratherAgent-to-Agent Connectionsthrough the identity provider rather than through ad hoc, user-granted OAuth consent. Agent-to-Agent Connections sets rules for which agents can call other agents, what each agent can access, and captures theClaude CodeAI agents don't live in one place. A Claude Code session on a developer's Mac authenticates to an identity provider, calls tools over MCP, reads files on disk and sends data to a model endpoint. Each step has its ownClaude Desktopgovernance intent into vendor-correct configuration on macOS. Initial support covers Claude Code, Claude Desktop and OpenAI Codex. The result is three capabilities:Configuration Designercall other agents, what each agent can access, and captures the handoff in an auditable chain. Configuration Designer visually maps agent-to-resource connections so the handoff is governed, scoped, and auditable.Jamf AI GovernanceJamf AI Governance has been available in Jamf for Mac since June. It works through the management channel admins already use. Jamf monitors supported AI platforms for new or changed controls and translates governanceOkta for AI AgentsWho or what is this agent, and what can it access at runtime? Okta for AI Agents (Identity & Access)OpenAI Codexinto vendor-correct configuration on macOS. Initial support covers Claude Code, Claude Desktop and OpenAI Codex. The result is three capabilities:Resource Access Certificationsmaps agent-to-resource connections so the handoff is governed, scoped, and auditable. Resource Access Certifications reviews agent connections over time to prevent standing and excessive permissions.Shadow AI Agent Discovery for EndpointsOkta already discovers shadow AI agents and their connections across managed browsers. Shadow AI Agent Discovery for Endpoints extends discovery to devices where unmanaged agents run without IT and Security’s knowledge