Nominated-agent authorization
Requiring the user to nominate the agent that will act for them, rather than letting the agent nominate itself. The nomination record lets an agency refuse any agent the user never appointed.
The impact of agents
Nothing stops a software agent from presenting itself to a government service as authorized when no user ever appointed it. The difficulty is preventing an agent from authorizing itself and fixing who is responsible when it acts. Long-standing tax-agent authorization, refined over decades, is the closest precedent for how to do this.
What must be verified
An agency needs the nomination of an agent to be client-initiated, scoped to a typed level of authority, and tied to an accountable operator, so that an agent cannot authorize itself and responsibility for its actions is fixed.
Protecting access
The nomination step contains its own exclusion. Requiring the client to nominate an agent from inside their own authenticated session is a barrier for the exact users who want an agent because they can't operate digital services alone. It leaves them unable to authorize the help they need. A person under guardianship needs the nomination to be makeable by their guardian, in a form the agency recognizes.
Keeping the path open
- Offer telephone nomination, with identity verified through knowledge-based checks and the agent nominated verbally.
- Offer in-person nomination at a government shopfront.
- Accept nomination by a recognized intermediary with its own verifiable delegation chain.
Response surface
Levels of authority, from full representation down to discussing a single return, are set per agent by the user from their own dashboard.
Authorize an agent
You nominate the agent from your own account. It can never authorize itself.
{
represented: "Y. Kumar",
operator: "AccountingCo #12345",
level: "submit_and_view",
service: "tax",
initiated_by: "client"
}Created only when the user confirms — this preview tracks the level they pick. Nomination, the registry, and later verification all use the same set of defined terms.
Maturity
- Established
For registered human agents, where client-initiated nomination at typed authority levels runs in production at the ATO, IRS, and HMRC.
- Frontier Headline
For AI agent operators, where the registration, professional standards, and liability scaffolding the model depends on does not yet exist.
Precedents
ATO tax agent authorization. Tax agents must be registered with the Tax Practitioners Board, which makes them a regulated class of delegate, and clients nominate their agent from their own authenticated session. Authorization runs until the client revokes it, agents reach ATO services through myID and RAM, and a client can authorize different agents for different roles. The nomination step puts the grant on the principal's side of the boundary.
IRS Form 2848 and related authorizations. The IRS types authorization by what it permits: a Power of Attorney for full representation, a Tax Information Authorization for view-only access, a Third Party Designee to discuss a specific return, and Oral Disclosure for a single phone conversation. Individual taxpayers can authorize practitioners through their online account, and representation is limited to attorneys, CPAs, and enrolled agents. The scope of a delegation is a named type, chosen at the moment of grant.
HMRC Making Tax Digital agent authorization. HMRC is developing multiple-agent functionality under which different agents hold different permission scopes for the same taxpayer. It is the closest existing model to a scoped agent delegation, and it sits in research rather than in a shipped service.
What carries over to agent use
The tax agent model is the strongest existing analogue for AI agent delegation. Transferable elements: agent registration/accreditation (AI agent operators could be required to register with a regulatory body analogous to the Tax Practitioners Board, making the operator rather than the software responsible); client-initiated nomination (the user must actively nominate the agent through their own authenticated session, preventing self-authorization); typed authorization levels (view only, submit, represent, with appropriate ceremony for each); and multiple concurrent agents for different services.
Critical gap: tax agents are natural persons who bear professional liability. AI agent operators can be corporate entities, but the AI agent itself has no professional standing, no liability insurance, and no disciplinary body. The institutional scaffolding (registration, professional standards, complaints mechanisms) would need to be built for AI agent operators.
Where things go wrong
Where this goes wrong is agents self-authorizing, with no one bearing liability when an automated process fails at scale. Client-initiated nomination through the user's own session prevents self-authorization, and registering the operator as an accountable party fixes responsibility. An operator that hijacks or replays a client's authenticated session can complete the nomination step itself, presenting a self-appointment as though the client had made it. Requiring the nomination to originate inside a fresh, client-controlled session is what closes that path, not just the existence of a nomination step.
Sources
4 references
The instrument, the operating deployment, or the official record itself.
Writing about the subject rather than the framework itself, including vendor commentary.