Not the poster, but working on this right now.

The current framework that solves this the best right now is FiPA.

Establish identity the same way we always have, AS defines the challenges, the client (voice agent in this case) goes and gets them. OAuth from there!