Managed agent identity
An identity layer for the agent itself, so a relying agency can prove who authorized it, check what it may do, and stop it. An agency can confirm an agent's authority, or end it, without asking the user to understand the protocol underneath.
The impact of agents
When a user delegates to an AI agent that then deals with a government service, the agent itself has no identity the agency can check independently of the user who deployed it. No identity protocol answers this: OAuth, GNAP, and UMA are all built for natural persons and assume a human is operating the client.
What is missing is an identity layer for agents as delegates: verifiable provenance a relying agency can check at the moment of the request, and revocation it can act on before the next one.
What must be verified
A relying agency needs to confirm what an agent is, who authorized it, and what it may do, without contacting the user. It also needs to be able to prove that chain of authority and halt the agent when necessary. One party must issue and maintain that chain of authority: the agent operator, or an accredited issuer of the agent's identity credential.
Protecting access
Cryptographic identity is invisible by design, so the exclusion risk lives entirely in the management surface. A user who can't parse tokens, chains, or policy languages, which is nearly every user, is left unable to tell what their agent may do, what it has done, or how to stop it. This is felt most when something goes wrong and the evidence sits in a format only specialists read.
Keeping the path open
- Hold the management interface to three plain-language answers: what this agent can do, what it has done, and how to stop it.
- Make the stop control the most prominent of the three, operable by keyboard and assistive technology, and effective without the user understanding anything beneath it.
Response surface
A single panel answers what this agent can do, what it has already done, and how to stop it.
Manage what this assistant can do, review what it has done, and stop it at any time.
Stops everything immediately. You can start it again at any time.
The panel answers three questions in plain language. The signed token beside it is the machinery underneath. The user never has to read it.
Stop is the most prominent control: full-width, and operable by keyboard and assistive tech.
Maturity
Frontier for an identity layer that lets an agency prove an agent's chain of authority and halt it; no identity protocol designed for natural persons supplies this, and the response is undesigned.
Precedents
Agent Identity Protocol (AIP). The proposal introduces Invocation-Bound Capability Tokens combining public-key verifiable delegation, holder-side attenuation under which each intermediary can only narrow permissions, chained policy in Datalog, and provenance-oriented completion records. It defines transport bindings for MCP, A2A, and HTTP. It is the most complete published attempt at a delegation chain an agent can carry.
The AI Identity survey, and Verifiable Credentials for AI Agents. A survey paper maps current agent identity standards and the gaps between them, and a companion proposal would equip agents with Decentralized Identifiers and Verifiable Credentials, naming 'limited support for delegation of authority, insufficient contextualisation of trust decisions, and reliance on static trust models that fail to adapt dynamically'. The literature converges on delegation as the missing piece, and none of it has been adopted.
Agent interoperability protocols (MCP and A2A). Both major interoperability protocols now sit under neutral governance, MCP and A2A having been contributed to the Linux Foundation's Agentic AI Foundation. Neither solves agent identity or delegation natively. Both are transport layers an agent identity protocol has to bind to.
NIST NCCoE concept paper. A US national standards body records that no existing identity protocol handles the agent-as-delegate case, and names the standards any agent-identity protocol would build on: OAuth and OIDC, SPIFFE and SPIRE, SCIM, NGAC, and NIST SP 800-207 and 800-63-4. It is a concept paper and request for input, cited for the shape of the gap and the standards it names.
Estonia's AI-ID commitment. Estonia has committed to a native agent-identity layer that lets an agent act for a person or company within scope-limited, verifiable, and auditable powers. It is a government statement of intent, without legislation or a deployment behind it.
What carries over to agent use
The precedents cited above are at the research and early-specification stage. For government services, the question that matters is less which protocol to adopt than what properties the delegation infrastructure must have: verifiable provenance (any relying party can verify the delegation chain from user to agent without contacting the user); attenuation (delegation can be narrowed at each hop but never widened); revocability (revocation must propagate in near-real-time); audit (a complete, tamper-evident record of actions taken under the delegation); and interoperability (works across multiple government services, not locked to a single system).
Government services should track these standards but avoid premature commitment. The prudent approach: define the requirements (the five properties above), participate in standards development, and build to an abstraction layer that can adopt whichever protocol matures first.
Where things go wrong
The failure mode is a cloned or forged agent identity credential presented at the point of a request. Absent a provenance layer to check it against, a relying agency has no signal that distinguishes the look-alike from the agent the user authorized until after it has acted.
Sources
14 references
The instrument, the operating deployment, or the official record itself.
- Linux Foundation — formation of the Agentic AI Foundation (MCP, goose, AGENTS.md)
- Model Context Protocol — documentation
- Agent2Agent (A2A) protocol — documentation (Linux Foundation)
- NIST NCCoE — Software and AI Agent Identity and Authorization (concept paper)
- Estonia — government commitment to AI-agent digital identities ('AI ID codes')
-
Careful adoption of agentic AI services — Five Eyes joint cybersecurity guidance (ASD ACSC, CISA, NSA, CCCS, NCSC-NZ, NCSC-UK)
A joint Five Eyes publication recommending each agent be constructed as a distinct principal with a cryptographically anchored identity, held in a trusted registry periodically reconciled against the live set of agents, and access denied to any agent absent from it. Best-practice guidance, not a ratified standard.
- OpenID Foundation — Identity Management for Agentic AI (AIIM whitepaper)
- IETF OAuth — Identity and Authorization Chaining Across Domains (adopted; with the RFC Editor)
- AGNTCY — Agent Badge identity specification (Linux Foundation)
Writing about the subject rather than the framework itself, including vendor commentary.