Okta: The Blueprint Alliance AI-agent framework isn’t ours, but everybody’s

The Blueprint Alliance, the coalition of a dozen-odd technology companies working together to create common security and interoperability standards for agentic AI, isn't a bid for industry dominance, Okta executives told SC Media.

"Nobody else was taking the initiative to do it, so we wanted to actually come forward because we're big on standards, big on neutrality," said Sandeep Kumbhat, Okta Global Field CTO, during an interview last week at Okta's Oktane conference, where the Blueprint Alliance was unveiled.

"The premise behind the Blueprint Alliance," he added, "is to meet the customer where they are, to educate them that there are other elements of agent security design which you need to take care of."

Or, as Okta CEO and co-founder Todd McKinnon said during his Oktane keynote address, "No one company can secure AI agents alone."

Click here for more coverage from this year's Oktane conference.

That's despite the fact that many security vendors, ranging from data-security providers to network-security specialists to identity providers like Okta, still claim to have the one solution that will lock down your AI instances and protect them from compromise.

"Every security vendor offers to fix all your problems with AI," said Okta President and COO Eric Kelleher at a press briefing following McKinnon's keynote. "But in reality, it's going to take collaboration at every part of the stack — not just identity, but endpoints, integrations, et cetera."

There's little doubt that such standards are necessary, Okta Director of Okta Threat Intelligence Jeremy Kirk told us during Oktane.

"The Blueprint Alliance comes out of everybody realizing, well, we really have to get these fundamentals right now, because the technology's powerful, and we've definitely seen that in the last few months," Kirk said.

Or, as Travis Tripp, Chief Technologist for the HPE GreenLake Platform, said during a breakout session at Oktane, "We've got a brain in a jar making predictions, and when you give it a tool and credentials, you get consequences."

Four questions and six principles

To further AI development without creating further risk, the Blueprint Alliance's stated goal is to "build a practical framework for securing and governing agents at enterprise scale."

The idea is to build open, freely shared protocols and standards that all developers, model builders and vendors can adhere to in order to answer what Okta claims are the four fundamental questions about agentic AI:

Guiding the answers to those questions are what the Blueprint Alliance website lists as the six guiding principles, or at least the six guiding identity-management principles, for agent governance:

It's not clear how a data-security provider, for example, could implement those principles, although it might have an easier time shaping its approach to the four fundamental principles.

All members are committed to developing interoperability across several existing open standards, including the Model Context Protocol (MCP), the Open Cybersecurity Schema Framework (OCSF), the Shared Signals Framework (SSF), and the Continuous Access Evaluation Profile (CAEP).

"The idea is anything from a reference-architecture perspective, nothing proprietary gets built," Kumbhat explained. "These are more standard API calls or standard protocol calls. So the intent is never to actually build sophisticated integrations. It is more to share things, share signals on an existing protocol."

When and if such common standards are devised, then different tools in different parts of the software stack should be better able to share information and act quickly in response to rogue or compromised agent behavior, explained Kirk.

"If there's some risk signal that comes to CrowdStrike into Okta, they can build workflows around that and say, okay, well, if this happens, maybe step up MFA or maybe log out of the application or whatever sort of action that they want," Kirk told us.

Okta states that all members share the goals of "treating every agent as a first-class identity, scoping access to the task rather than granting standing access, keeping delegation traceable, monitoring runtime behavior continuously, enabling containment that is instant and reversible, and ensuring governance adapts at the speed AI moves."

Matt Immler, Regional CSO at Okta, told us at Oktane that the genesis of the Blueprint Alliance formed during cross-company discussions a year or so ago in the Interoperability Profiling for Secure Identity in the Enterprise (IPSIE) framework working group.

"Everybody had their own part, but we realized that we didn't speak the same language. So what came out of that is this shared-signals framework," Immler said. "It led to a set of standards that all these companies agreed upon, like we should all have SSO, we should all do this type of logging, we should all have this core set of principles that we abide by."

Who's in, and who hasn't yet joined

Notably, Okta is the only identity provider among the 13 founding members of the Blueprint Alliance.

The others include an endpoint-security provider (CrowdStrike), a data-analytics provider (Databricks), two cloud-security providers (Wiz and Zscaler), an email-security provider (Proofpoint), a for-profit open-source support provider (Docker, Inc.), and a vibe-coding platform provider (Lovable).

More significant is the presence of both Salesforce and ServiceNow, two cloud-based companies deeply embedded into American business culture. Also significant is that Amazon Web Services is a member, but not Amazon as a whole. Likewise, Google Cloud, but not Google as a whole, is participating. (Google also owns Wiz.)

"We truly believe that for AI to be successful, all of the vendors have to come together," said Bakhti Pitre, VP of AI Platform Security at ServiceNow, during a breakout session about the Blueprint Alliance at Oktane.

The remaining two members might be unexpected and are listed as "strategic advisors": GE Appliances, now owned by Haier, and the nonprofit charity World Central Kitchen. The Blueprint Alliance press release explains that they "will help the Alliance refine and validate the approach to securing AI."

Then there's the big missing elephant in the room: No AI frontier-model developers, such as OpenAI, Anthropic or their smaller rivals, are on board.

However, an Anthropic staffer did appear with McKinnon during his keynote, and Anthropic presented a breakout session during the conference.

Anthropic and OpenAI are already among the sponsors of another AI-security working group. The Coalition for Secure AI (CoSAI), created in 2024, has more than 50 sponsors, including Microsoft, Google, Amazon, Meta, IBM, Nvidia, EY, Cisco, Dell, Intel, Lenovo, and, representing the identity providers, SailPoint.

Its goals are similar: "to invest in AI security research collectively, share security expertise and best practices, and build technical open-source solutions and methodologies for secure AI development and deployment."

Regardless, Okta executives expect that more companies will soon join the Blueprint Alliance.

"As the news gets out [about] the level and names of folks that are a part of it and the initiatives," said Immler, "I think a lot of these companies are going to be like, OK, well, maybe we do want to be part of that."

Microsoft's Entra ID system is Okta's biggest competitor. No one at Okta is holding their breath waiting for Microsoft to come on board, and it's possible that Microsoft, as it did with word processing and web browsers, will try to impose its own set of agentic-AI standards.

"Microsoft has always done this, they always have had an ecosystem," said Kumbhat. "I think the different thing with this particular agentic era is Microsoft apps are not in the race."

Asked to clarify, Kumbhat explained that Microsoft Copilot and Agent 365 are being widely used by customers, "but the outcome they are using it for is more automation rather than really AI."

"When it comes down to real agentic use cases, that's where real models are going to come into the picture," he added. "They will need something like an alliance, some reference models and architectures. And that's where we are going to come into the picture. Because people know us for being neutral on that."