Kerberos Won Because Nobody Had to Implement It
The SSPI Question for Agent Authorization
The question worth asking about AAuth is not only whether the protocol is good. Kerberos won because of everything around the protocol: SSPI and GSS-API hid the mechanism from application developers, the LSA owned keys and ticket lifecycle, machine accounts existed as a side effect of domain join, Active Directory shipped the KDC by default, and SPNEGO made rollout incremental. Mapping that stack onto agents names the first control point in this series: the provider seam through which a harness or gateway acquires and presents credentials without exposing the mechanism to agent logic. MCP clients, SPIFFE, cloud identity systems, vendor brokers, and HTTP message-signature negotiation supply pieces, but no general seam composes them. That seam still cannot decide whose agent is running, which work is approved, or whether a resource permits one action. Those are separate records and decisions.