authentication (AuthN)

basicwidespread

Authentication is the step where a system verifies that you are indeed who you claim to be, for example with a password, fingerprint, or code.

In plain terms

Authentication is like when a doorman asks for your ID card before letting you into the building. They are not interested in what you want to do inside, only whether you are truly who you claim to be.

In the digital world, the same happens with every login. You enter your password, place your finger on the phone, or provide the code received by SMS, and the system decides whether you are truly who you claim to be.

In the age of AI agents, not only people but also programs must be authenticated. When an agent reads your emails or books appointments on your behalf, the service must know which agent is knocking and on whose authority.

Authentication is only the first gate. What you can access inside is decided by a separate step: authorization.

How it works

First, you state who you are: you provide your username, email address, or, in the case of a program, its identifier.
Then you prove it with something. This can be something you know (password, PIN), something you have (phone, security key), or something you are (fingerprint, face).
The system compares the evidence with what it previously stored about you. Ideally, the password is not stored in plain text but as an irreversible hash.
If the verification is successful, you receive a temporary login (session or token) so you do not need to re-verify yourself with every click.
Programs and agents typically do not type passwords but present an API key or an expiring token, which the owner can revoke at any time.

An everyday example

You log into your online bank: you enter your password, then approve the login via a notification on your phone. This is two-factor authentication because the bank requested two independent proofs: something you know and something you have. A similar process occurs when connecting an AI assistant to your calendar: Google first logs you in, which is authentication. When it then asks if you authorize the assistant to access your calendar, that is granting permission.

Who is affected

everyoneYou authenticate with every login, and the security of your accounts depends on how strong this step is.

developerYou must ensure that your application and the agents working within it authenticate themselves securely to other systems. → Code

entrepreneur, executiveOne of the most common intrusion paths to corporate data is weak or stolen login credentials, making this a business risk as well.

bank customer, investorAccess to your money is protected by strong customer authentication, which is required by EU law. → Money

A common misconception

MythOnce I have successfully logged in, I have access to everything in the system.

In realityAuthentication only verifies who you are. What you are allowed to do is defined by a separate step: authorization management.

Limits and risks

A password alone is weak protection because it can be guessed, stolen, or phished, so enable two-factor authentication wherever possible.
Second factors are not all equally strong: a code received by SMS can also be phished or hijacked, while passkeys and security keys resist phishing.
Authentication verifies that the person logging in knows the secret, but not that their intentions are good: with a stolen password, the attacker becomes "you".
If you give an agent your login credentials or a key, it acts on your behalf, so grant it only the access absolutely necessary.
Due to voice- and face-mimicking AI, phone or video 'I recognize your voice' type identification is no longer reliable.

Similar, but not the same

authorization – Authentication determines who you are, while authorization determines what you can access.
identification – During identification, you simply state who you are; during authentication, you must prove it.
encryption – Encryption makes data unreadable to unauthorized parties, while authentication verifies the identity of the person logging in.

Related concepts

Broader

IT security, access control, digital identity

Narrower

two-factor authentication, password, biometric identification, passkey, single sign-on

On the edge

authorization management, API key, token, OAuth, phishing

A brief history

Computer password-based login was introduced in the early 1960s on the CTSS, a shared system at MIT, under the direction of Fernando Corbató. The goal was to separate users' files from one another. Since then, a second step, biometrics, has appeared alongside the password, followed by passwordless solutions.

Where things stand

At the end of 2026, two-step authentication is a basic expectation, and passwordless login (passkey) is spreading rapidly among major providers. Reliable authentication for agents, however, is still a developing area without unified practices.

Status: 2026 November

In the news

Appears in 194 Agent Age stories; the curve shows weekly occurrence in the news magazine.

Ethan Mollick publishes Portals, a browser-based 3D experience of 471 generated worlds built by agent teamsNov 9, 2026 · Code
Hamburg data protection authority drafts letters with an OpenAI model as complaints rise 62%Nov 8, 2026 · Jog
RAND study models AI job-loss impact on wages, taxes and public servicesNov 6, 2026 · Work & HR
Singapore faces fears of a 'broken' career ladder as CEOs praise AINov 5, 2026 · Work & HR
Three charged with stealing $129 million from companies by impersonating CEOs with AINov 5, 2026 · Money
FCA to launch quantum machine learning pilot group in 2027 to tackle fraud and money launderingNov 5, 2026 · Money
Anthropic copyright settlement could benefit Herald Press authorsNov 5, 2026 · Jog
OccupySaaS open-source project uses AI to clone costly servicesNov 4, 2026 · Code

Also known as

authentication · authentication · authenticating · identification · authentication · auth · AuthN · user onboarding

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.