Twenty-five software makers have now signed on to Okta Inc.’s Cross App Access framework, a move that forces a hard question on every business using AI agents: who is watching the door? San Francisco-based Okta announced the expansion on June 23. The list of early adopters includes Asana Inc., Atlassian Corp., Cloudflare Inc., Datadog Inc., Salesforce Inc.’s Slack, Zoom Communications Inc., and Anthropic PBC’s Claude.
Also joining are Canva Pty Ltd, Docker Inc., Figma Inc., Linear Orbit Inc., Supabase Inc., and developer tools Anysphere Inc.’s Cursor and Microsoft Corp.’s Visual Studio Code. The framework routes every connection an AI agent makes to enterprise applications through a company’s existing identity controls.
It is built as an extension of OAuth and now serves as an official authorization extension for the Model Context Protocol, the standard connecting AI models to outside data and tools. What is at stake is simple. Most agent connections today still depend on static API keys.
A static key never expires. It never asks who is using it.
It never logs where the data went. If an agent with a static key is compromised, an attacker can roam through internal systems undetected until someone notices the bill or the breach. This is the problem Okta’s Cross App Access, introduced in June 2025, was built to solve.
The framework governs agent-to-app and app-to-app connections. It forces every handshake between an AI agent and a corporate tool to pass through the same identity checks a human employee would face. No key.
No back door. No silent crawl through company data.
The integrations span three categories: tools where employees start their work, applications holding corporate data, and the developer infrastructure that routes agent traffic. That means an agent working inside a developer environment like Visual Studio Code or Cursor must authenticate before pulling data from a corporate database. An agent inside Slack must pass identity checks before it can read messages or files.
The diversity of the partner list matters. It includes companies handling employee productivity, corporate data storage, and developer tooling.
That range signals a growing recognition across the software industry that AI agents cannot be treated as trusted insiders by default. They have to be managed like any other user. Okta’s framework is not a product.
It is a standard. It extends OAuth, the widely used authorization protocol, to cover agent connections. By becoming an official extension of the Model Context Protocol, it embeds identity control into the fundamental architecture of how AI agents connect to outside systems.
That is a structural change, not a patch. The stakes are concrete.
A company deploying AI agents without this kind of control is running on trust. Trust that no agent will be hijacked. Trust that no static key will be leaked.
Trust that no agent will access data it should not see. Those trusts have failed before.
Static API keys have been exposed in source code, in logs, in compromised third-party services. The difference now is that agents can act on those keys automatically, at machine speed, across multiple systems before a human notices. Okta’s expansion does not solve every problem.
It does not police what agents do once they have access. It does not audit every action an agent takes. But it closes the front door.
It ensures that every agent connection is authenticated, authorized, and logged against a company’s identity system. That is a baseline.
Without it, the rest of the security stack is guessing.
{“@context”: “https://schema.org”, “@type”: “NewsArticle”, “headline”: “Okta adds 25 partners to Cross App Access framework for AI agent security”, “description”: “Twenty-five software makers have now signed on to Okta Inc.’s Cross App Access framework, a move that forces a hard question on every business using…”, “datePublished”: “2026-06-23T11:12:00+00:00T09:30:00+00:00”, “author”: {“@type”: “Person”, “name”: “Erika Johnson”}, “publisher”: {“@type”: “Organization”, “name”: “InfoPulse Today”, “url”: “https://newsfeed.infopulsetoday.com/”}}
