Identity Doesn’t Create Maturity. Work Does.
If Nothing Moves, Identity Doesn’t Matter
Two comments came up in an analyst call this week that immediately stuck with me.
“Customers want a neutral, independent identity platform
that can be easily deployed and support the maximum number of use cases,
particularly as they begin to introduce AI into workflows and business processes.”
“Agents are emerging as a new identity type,
and organisations now need to figure out how to govern them.”
It took me a few minutes to work out why they didn’t quite land with me. When taken in isolation both are true. But I think they also make it too easy to assume the problem begins with identity. And that’s the part worth challenging upfront, for the benefit of both customer organisations and technology providers.
The first could lead someone to assume that organisations are ready to drop AI into workflows, as if those workflows already exist in a coherent, structured form. They don’t. The second could lead someone to assume that agents are primarily a governance problem, as if their existence is what creates the need for control. They are not. In reality, I think both are downstream effects of something else entirely. Work.
Organisations do need a neutral identity platform. But not because they’ve decided identity is important. They need it because work has become fragmented across systems, channels, and now increasingly across humans and machines. The moment work starts to span boundaries, identity becomes operationally difficult. The same applies to agents.
Agents are not interesting because they are a new identity type. They are interesting because they are a new form of work execution. They take actions. They trigger processes. They make decisions, or at least simulate them. That is what forces identity into the conversation. Not their existence, but their behaviour.
If an agent never acted, it wouldn’t need an identity. It would just be software. The identity requirement emerges the moment the agent participates in workflow. This is the context that often goes missing. No work, no identity.
The identity platform market is not expanding again because identity is evolving. It is expanding because the nature of work is changing. The last time identity surged was with SaaS, when the problem was access. It was all about getting the right people into the right systems.
This is very different. AI is not increasing access. It is increasing action. More interactions, more autonomy, more delegation. Identity is being reintroduced as a problem because something now needs to govern all of that movement.
That’s why the idea of a neutral identity platform resonates and why platforms like Okta are a strong day one choice. Not because neutrality is inherently valuable, but because organisations are struggling to maintain control across an increasingly heterogeneous environment. Multiple systems, multiple vendors, multiple execution layers. Identity becomes the only thing that can sit across all of it.
But even then, it is still responding to something else. The deeper question is not how to govern agents. It is what work those agents are being asked to perform, and whether that work is actually understood, structured, and worth automating in the first place.
Because if the underlying workflows are still fragmented, manual, or poorly defined, then introducing agents does not create value. It simply accelerates inconsistency. And wrapping that in a strong identity model does not fix it. It just makes it governable. Yo end up with controlled chaos.
This is the pattern that is starting to emerge. Identity vendors are correctly identifying that the world is becoming more complex, more distributed, and more autonomous. They are positioning identity as the layer that brings order to that complexity. But the complexity itself is not coming from identity. It is coming from work that has outgrown the structures designed to support it. Which leads to a more grounded way of thinking about it.
The next phase of the market will not be defined by identity alone, but by how clearly it is connected to the work it is there to govern. The identity vendors that recognise this best, and are most articulate about anchoring their story in workflow, action, and outcomes, will find themselves riding a much larger wave. Because identity does not create the demand. Work does.
Identity scales as work scales. It becomes more critical as work becomes more distributed, more automated, and more autonomous. But it is always responding to something else. So the opportunity for identity providers is not to compete for primacy, but to align more directly with where value is actually created. To move closer to the systems and platforms where work is defined, executed, and increasingly delegated to machines. Done well, this will not diminish identity but amplify it.
Because when identity is tied to action (who or what is allowed to do something, not just access something) it becomes part of the operating model, not just the control layer around it. And that is where the market expands. Agents make this unavoidable. They are not a new identity problem, but a new form of work execution. And as that work scales, identity is pulled into it. Which is why identity and workflow cannot stand apart for long.
An identity layer without coherent workflows has nothing meaningful to control. A workflow layer without identity has no safe way to scale. They are not competing abstractions. They are interdependent as I called out in the Whatever-as-a-Service post.
The organisations that recognise this will stop treating identity and workflow as separate domains, and start treating them as two sides of the same operating model. One defines what can happen. The other defines who or what is allowed to make it happen. This is where the market is heading.
Platforms like ServiceNow and Salesforce are expanding identity capabilities because they need control over the work they orchestrate. Identity providers like Okta are moving closer to workflow because they need context to remain relevant. The centre of gravity is shifting toward the intersection. And in an agentic world, that intersection becomes the system.
Agents don’t just need identities. They need roles, permissions, and boundaries tied directly to the work they perform. That requires more than authentication. It requires a shared understanding of entities, states, and actions. That’s an operational ontology that both identity and workflow systems can interpret in the same way.
Without that, identity and workflow drift apart. With it, they reinforce each other. Which is why the likely winners will not be those who dominate one layer in isolation, but those who align both. Not simply around access or automation but around coordinated, governed action. That is where the real value sits.
Behind all of this sits a relatively well-defined group of control-plane identity providers. But the strongest will no longer be those with the best integrations. They’ll be the ones closest to the flow of work. For paid subscribers, I’ve put together a short view of where I think the major vendors sit today against this shift.