SECURITY ATLAS / EVALUATION BRIEF
Oasis Agent Identity Security
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/oasis-agent-identity/

THE ATLAS TAKE
Oasis is worth evaluating when agents inherit scattered non-human identities and delegated access that the organization cannot clearly inventory or govern. Its useful control purpose is identity context, entitlement review and supported remediation, rather than interpreting every prompt. Atlas would focus on a known OAuth or service-identity path: can the team identify its owner, explain effective access and remove unnecessary authority? That exercise should include existing tokens and sessions, because changing a directory record is not always the same as ending resource access. Task-level runtime authorization remains a complementary control.

SCOPE
Scope the evaluation to identity discovery, entitlements and supported permission remediation. Identity posture does not establish task-level action enforcement.

WORTH A LOOK WHEN
Identity teams governing agent-associated service accounts, OAuth grants and other supported non-human access.

THINK TWICE WHEN
The requirement is detecting prompt attacks or deciding the business intent of every tool action.

IMPLEMENTATION
1. Select a real identity pattern
Choose a safe OAuth grant or service identity with a named owner and clearly unnecessary test permission.

2. Validate effective authority
Compare the platform finding with resource-native permission and access evidence.

3. Exercise lifecycle completion
Approve reduction or revocation and test fresh requests, existing tokens and relevant sessions separately.

OPERATING REALITY
Identity and application owners must maintain connectors, ownership and remediation approvals. Permission findings need validation against effective target access, especially with delegated grants and shared credentials. Offboarding should include token/session behavior and resource-side confirmation so a resolved posture finding does not conceal still-valid access.

COMMERCIAL CONSIDERATIONS
Quote the connected systems, identity scope and remediation functions explicitly. Include connector privileges, application-owner review and any separate lifecycle tooling.
- Connected platforms and non-human identity scope
- Selected posture/lifecycle/remediation functionality
- Connector administration and owner adjudication effort

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Discover a known test OAuth grant
Acceptance evidence: Retain owner, scope and authoritative target records.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Remove one excessive permission
Acceptance evidence: Verify effective access changed while the required task still works.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Decommission a disposable agent identity
Acceptance evidence: Test new access and already issued credentials/sessions separately.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Which delegated OAuth grants are visible?
- Can the product remediate this grant directly?
- Does revocation invalidate existing sessions and tokens?

EVIDENCE GAPS
- Atlas has not independently measured discovery completeness or revocation speed.
- Confirm connector-specific remediation support and token/session invalidation behavior.

SOURCES
Oasis: AI adoption and delegated-access controls (Product information)
https://www.oasis.security/solutions/ai
Oasis: NHI inventory, context, and lifecycle (Product information)
https://www.oasis.security/product
Oasis agent governance and identity boundaries (Product information)
https://www.oasis.security/blog/agent-365-oasis-for-ai-agent-governance

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.