FusionAuth 1.70 Adds Secure Access for Customers' AI Agents

FusionAuth has released version 1.70 of its identity and access management platform, adding capabilities designed to let businesses securely grant AI agents access to their applications on behalf of customers. The update positions FusionAuth to handle a new category of non-human, agentic users that need to authenticate and act within customer-facing systems.

Rather than treating AI agents as an edge case bolted onto existing login flows, the release treats agentic access as a first-class identity scenario — giving companies a sanctioned way to let a customer's AI assistant retrieve data, complete tasks, or interact with an app without requiring the customer to share raw credentials or disable security controls.

As AI agents move from chatbot novelty to genuine task-doing proxies — booking, comparing, purchasing, managing accounts — the question of how those agents authenticate becomes a core infrastructure problem, not a feature request. Identity platforms have traditionally been built around the assumption that a login event means a human is present. FusionAuth 1.70 is a signal that this assumption is breaking down, and that access-management vendors now need to model delegated, machine-initiated sessions as a standard pattern rather than a workaround.

For digital transformation and experience leaders, this matters because it shifts a security and architecture decision into a customer-experience decision. How an organization authenticates agents determines whether AI-driven interactions feel seamless and trustworthy or clunky and risky. Getting agentic access right early — with clear scoping, consent and auditability — will determine which companies can safely let AI agents act on customers' behalf as adoption accelerates, and which get left exposed or left behind.

This release is less about a single product feature and more about an infrastructure layer catching up to a behavioral shift that's already underway: customers increasingly want to delegate tasks to AI rather than perform them manually.

Most organizations are still debating whether to "allow" AI agents into their ecosystem, when the real design question is how much trust to delegate, and under what guardrails. Identity and consent architecture is now a frontline experience decision, not a backend technicality — get it wrong and customers either feel surveilled or get locked out of the convenience they came for. The operators who win here will treat agent authentication the way they once treated single sign-on: invisible to the user, but meticulously governed behind the scenes. Waiting for agentic access to become a "mature" category before building for it is itself a decision — and a risky one.