Why is identity verification insufficient for AI agents?
Identity verification alone cannot secure an environment where software acts autonomously because it fails to validate the scope of an action. Digital trust has historically rested on a simple assumption: that behind every login or decision, there is a person. Passwords and multi-factor authentication were built to confirm that whoever was asking had the right access, but they were never designed to answer the questions that AI agents are now making unavoidable.
To understand the gap, we must break digital trust down into three separate checks: Authentication, Identity, and Authority. Authentication answers whether you can access a system; Identity answers who you are; and Authority answers who authorized you to act, what exactly you can do, and for how long. Most of today's infrastructure was built to solve the first two. Agents, however, are what make the third one impossible to ignore.
AI agents are increasingly completing transactions and handling administrative tasks that used to require human oversight. Because many existing systems were not built to distinguish a person from an agent, or a legitimate agent from an unauthorized one, they simply confirm that the entity holds the right credentials. They fail to confirm whether that entity actually has the authority for the specific action it is attempting to take.
The distinction between identity and permission
For businesses, proving a person's identity has always gone hand in hand with checking what they are authorized to do. Consider an employee approving a payment on a company's behalf: the organization relying on that action needs to know not just who the employee is, but whether they are currently entitled to execute that specific transaction. Identity alone does not tell you what someone is allowed to do.
In highly regulated sectors like financial services and healthcare, this distinction is already a core part of the infrastructure. These industries already layer eligibility and role checks on top of identity verification to ensure compliance and security. As AI agents begin to act more inside business workflows, this distinction is becoming a universal requirement. Identifying the agent behind a request does not inherently show who authorized the action or whether that action falls within the permissions originally granted. As more business processes are offloaded to agents, the gap between identity verification and the application of delegated authority will only widen.
What are the risks of broad access for autonomous agents?
The primary security risk associated with AI agents is the tendency toward broad, standing access. It is often easier for developers to build agents that inherit a human user's full permissions, but this practice creates a massive attack surface. When an agent has standing access to everything behind a login, a single compromised or mis-scoped agent can do far more damage than a narrowly scoped one ever could.
To mitigate these risks, organizations must adopt the principle of minimum necessary authority. This discipline, similar to how good identity design applies to documents, suggests that we should ask for and grant only what a transaction actually needs. An agent completing a task should be able to prove it holds a specific, limited mandate for that specific task, rather than possessing broad access to an entire system. By moving toward narrowly scoped mandates, businesses can ensure that even if an agent is misconfigured, its ability to cause widespread operational damage is strictly limited.
How can businesses prepare for delegated AI authority?
Preparing for delegation requires a fundamental shift in timing: moving the authority check earlier in the process. Instead of discovering a problem after an agent has acted incorrectly, authority should be confirmed before the agent ever begins the task. This means moving from a model of "access sharing" to a model of "explicit delegation."
An organization should provide an agent with a specific, limited job rather than simply giving it a copy of a person's own access rights. This requires keeping a clear, auditable record of who granted that authority and exactly when it can be pulled. For any agentic action to be considered secure, a business must be able to answer five fundamental questions:
- Who, or what, is acting?
- Who authorized it?
- What can it do?
- Under what constraints must it operate?
- Is that authority still valid?
This framework maps closely onto the 'on-behalf-of' (OBO) delegation models already used in existing identity standards. Utilizing these established models provides a promising foundation for businesses to build upon, rather than attempting to invent entirely new systems from scratch. Without these answers, a mis-scoped agent could quietly approve a payment or access data it was never intended to touch.
How should regulatory frameworks evolve to govern agents?
The role of government in this transition is to extend existing infrastructure rather than building entirely new systems. In the United Kingdom, significant progress has already been made regarding identity. The Data (Use and Access) Act has put Digital Verification Services (DVS) on a statutory footing, and some use cases have even introduced mandatory identity verification for directors and people with significant control.
However, the DVS Trust Framework currently faces a new challenge. While it already recognizes delegated authority when a person acts on behalf of someone else or an organization, it does not yet address how these principles apply when the delegate is software. The UK now needs to determine how its existing delegated-authority thinking extends to the case of AI agents. The goal is to enable agents to present a machine-verifiable mandate—a digital proof of who authorized them, what they can do, and for how long.
One plausible technological home for these mandates is the digital wallet. By sitting alongside a person's or organization's verified credentials, a digital wallet could allow an agent to present its mandate for instant verification or revocation. The UK has a narrow window to work out these standards before the deployment of AI agents outpaces the systems meant to govern them.
Bridging the gap between law and technology
The convergence of law and technology is critical to closing the authority gap. While the Data (Use and Access) Act and the DVS Trust Framework have laid much of the groundwork for secure, reusable digital identity, the technical implementation of software-based delegation is the next hurdle. If the regulatory framework fails to keep pace, businesses will be left navigating a landscape of unstandardized and potentially insecure agentic workflows.
The opportunity for the UK lies in extending the principles it has already established. By building on the foundation of digital identity, the goal is to create a system where machine-verifiable mandates are as standard as human identity verification is today. This ensures that as agents become more autonomous, they remain tethered to human oversight and organizational intent.
Frequently asked questions
What is the difference between identity and authority in AI?
Identity refers to the verification of who an entity is, such as a specific person or a verified software agent. Authority refers to the specific permissions and limits granted to that entity, defining exactly what tasks it can perform and for how long it holds those rights.
Why are AI agents a new security challenge?
AI agents are a challenge because they can perform complex tasks autonomously using human credentials. Traditional security checks verify that the credentials are correct, but they often fail to verify if the agent has the specific authority to execute the particular transaction it is attempting.
What is the principle of minimum necessary authority?
This principle dictates that an AI agent should only be granted the absolute minimum level of access required to complete its specific task. By avoiding broad, standing access, organizations can limit the potential damage if an agent is compromised or makes an error.
Can existing identity standards help manage AI agents?
Yes, existing "on-behalf-of" (OBO) delegation models used in identity standards provide a strong foundation. These models can be adapted to ensure that when an agent acts, it does so under a clearly defined, verifiable mandate granted by a human or an organization.
What role do digital wallets play in agent security?
Digital wallets could serve as a secure repository for an agent's machine-verifiable mandates. These wallets would allow an agent to present its specific permissions, constraints, and expiration dates to a system, which can then instantly verify or revoke that authority.
Key takeaways
- Security must shift from simple identity verification to granular authority management for AI agents.
- Agents should operate under the principle of minimum necessary authority to reduce security risks.
- Effective delegation requires answering five questions: Who is acting, who authorized it, what can it do, under what constraints, and is it still valid?
- Regulatory frameworks must extend existing delegated-authority models to include software-based delegates.
The future of digital trust
The transition toward an agentic economy necessitates a fundamental shift in how we perceive digital trust. We are moving away from a world where trust is established by a successful login and toward a world where trust is proven through continuous, verifiable mandates. In the near future, the security of a business will depend less on the strength of its passwords and more on its ability to prove that every action taken behind a screen—whether by a human or an AI—is authorized, scoped, and legitimate.
