Idira gives AI agents SPIFFE identities, MCP tool limits

Idira's August release is the first in a monthly series that reads the platform's release notes and pulls out changes worth attention. The company frames the batch around two shifts: machine identity moving from static secrets toward workloads that prove what they are and receive short-lived credentials, and AI agents becoming identities to register, govern, and audit rather than "shadow scripts running around with someone else's token."

The agent-side changes converge on giving each agent a governable identity. MCP access policies link the users who can start a session, the agents they operate through, and the specific tools on an MCP server. Separately, agents can now be linked to cloud-native identifiers such as an AWS ARN or an app ID during registration, matching a newly registered agent to one already in discovered inventory. For agents on the Google Gemini Enterprise Agent Platform (formerly Vertex AI), Secure Workload Access issues unique SPIFFE identities and short-lived tokens with trust domains and policy managed centrally.

On the workload side, Idira reduced friction: workloads can be edited in place from the Workloads page, while authenticators without permission now show only their type and Service ID. On secrets, unmanaged secrets can be deleted synchronously from Secrets Hub, and account changes from Privilege Cloud sync to Secrets Manager SaaS shortly after they happen. A secret read now reflects Privilege Cloud changes in close to real time rather than after the next sync cycle, which is the practical payoff — though whether that latency holds across all regions is the kind of thing operations teams will likely test.