What happened
At the Google Cloud Security Summit (Nov 5, 2026), Google announced Auth Manager for agent identity is now generally available — centralized credential management in a Google-managed IAM-governed vault that automates OAuth 2.0/PKCE flows and refreshes user-delegated tokens. It also previewed Agent Identity JWT support, which issues standard OIDC tokens so agents can authenticate to AWS, Azure, on-prem backends and MCP servers without static long-lived API keys. Google also made identity-based VPC Service Controls (IAM roles) GA and previewed Workload Identity Federation for GKE.
Why it matters
Agent credential handling is a top attack surface: static API keys and over-privileged OAuth grants let a compromised agent become a lateral-movement path. A GA, IAM-governed credential vault plus short-lived cross-cloud OIDC tokens directly reduces credential theft and consent fatigue for autonomous agents.
Applicability
Security and platform teams running agents on Gemini/Google Cloud or coordinating agent identity across AWS/Azure/MCP should evaluate Auth Manager and the JWT preview now.