Episode 226: UMA What's Next?
September 22, 2026 · 1 min read
"May your agent touch my stuff?" Answering it needs an authority on the owner's side, one the resource server does not control, and it needs a negotiation to fill that authority in while the owner is elsewhere. UMA worked this out in 2018. What it did not anticipate is a requester that arrives thousands of times a day, holds its own key, and can be asked to agree to something.
UMA for Agents is a profile of User-Managed Access 2.0: the party asking for access is an autonomous agent, it belongs to somebody else, and the person who owns the resource is not at the keyboard. Will the UMA for Agents profile finally help Alice and Bob share? Tune in to find out with three Umatarians, Eve, Nick and Mike.
#Speakers
- Host: Mike Schwartz, Founder/CEO Gluu
- Guest: Eve Maler, Digital Identity Strategist and Founder of Venn Factory
- Guest: Nick Gamb, Principal Solutions Architect, Strata Identity
#Homework
#Takeaways
- The UMA’s resource-centric model fits an agentic world--AAuth agrees with this view too. So it kind of follows that “Bring your own authorization server” could give people and organizations greater control over their policies, privacy and consent.
- Personal AI may act as consent intelligence—applying advance directives, asking for approval or negotiating access when the resource owner is unavailable.
- Authorization must cover more than access. Restrictions, obligations and terms of use need to be recorded and enforceable without sacrificing interoperability.
- Agent authorization requires evidence. Signed terms, verified claims and execution logs are needed to prove what was requested, approved and ultimately done.