Say you run platform security at a company that is about to let software agents touch real systems. A vendor deck lands on your desk, and it says the right things about agent identity. You want to know how much of it you can actually rely on, and how much of it you could even see from the outside.
Start with what Palo Alto Networks laid out. It described five areas of work with NVIDIA in support of the NVIDIA OpenShell Reference Architecture: an AI gateway on Vera CPUs, runtime protection on BlueField DPUs, agent identity governance on NVIDIA Sentry, signals into an AI-driven SOC, and partner services.
The product list is not the interesting part. The argument underneath it is. The post says, "Agents can be steered past their guardrails, and a compromised host cannot be trusted to accurately report what occurred." If the host can lie, the controls have to live somewhere the host cannot reach. The post's answer is the DPU. You can follow that logic, and you would probably want it whichever vendor ended up selling it.
The post also draws a clean line between two jobs. In its words, "Runtime protection answers what an agent is doing. Identity governance helps determine whether it is authorized to do it." The goal it states is a verifiable identity for each agent, access appropriate to its task, and attributable actions. That goal holds up on its own merits.
Before you rely on any of it, read the tenses. AI Runtime Security on BlueField is described as generally available. The identity integration is not. Palo Alto says it is advancing one, and that once available it will deliver zero-trust protection and tamper-resistant auditing. So the part you most care about is still a plan. The post also mentions increased token throughput without giving a number, and it promises comprehensive security across every layer of the AI factory, which is a vendor's sentence. What survives your reading is the separation itself, plus a sharp statement of the problem.
Now comes the turn. The APIs.io catalog can test how much of this an outside developer or agent can see today, so you look at Palo Alto's own record.
The company is an enormous API estate, with 599 API pages. The catalog description lists Cortex XSIAM among the products on its developer platform. Yet no API page in that list carries Cortex, XSIAM or runtime in its name, so this announcement has no obvious page to land on. The nearest named surface is the AI Sec Profile API. The catalog is careful about what that means: it is a limit of what can be matched by name, not proof that nothing exists. And the bulk of the announcement is infrastructure rather than interface. Enforcement in silicon does not need a public endpoint. A governance story that wants to be checked eventually does.
The overall numbers are strong. The Kin Score is 75.3, exemplar, and the post says this is a company that earns it: developer ergonomics at 85.7, contract governance at 79.1, discoverability at 78.6. Access clarity, at 40.0, is the outlier. Agent Readiness is 48.6, and its lit dimensions are real ones, including auth clarity, error semantics, reversibility and a dry-run mode. The agentic access profile records 3,923 operations, 1,883 of them acting and 55 flagged human-in-the-loop.
Then you read the unlit list against the vendor's own thesis. Delegated identity, consent identity, protected resource metadata, dynamic client registration and agent card are all dark. Palo Alto is writing plainly about whose authority an agent carries. The record cannot yet find, at its own front door, how an agent would present that authority.
So here is what you take away. The separation argument is worth keeping: put controls where a compromised host cannot reach them. The identity half is a future promise, not a shipped product. And the gap between the announcement and the public record is something you can ask about. Before you sign anything, ask where an agent's delegated identity and consent show up in the interfaces you can inspect today, and ask when the identity integration actually becomes available.
Read the original: https://apis.io/2026/11/02/palo-alto-networks-moves-agent-identity-into-silicon-its-record-has-not-followed/