Delegation & Authorization

Letting a person give an AI agent permission to act for them, in a way an agency can check is real and bounded. A delegation defines how much the agent can do and for how long. The person who grants the authority is not present when the agent uses it. A single grant can carry many actions, across several services and over time. The agency cannot ask the user about any one of them.

Two requirements follow. A user has to hand authority to an agent and take it back at will. The agency has to know, each time an agent acts, that a real grant from the user stands behind it. An agency that acts through agents of its own has to answer for them too. Its authority comes from statute and internal delegation, not from a grant a person issued and can withdraw. The person dealing with that agent has no equivalent grant to check.

Policy challenge

As users begin authorizing AI agents to act for them across government services, the agency has to establish that any given delegation is genuine, still in force, and limited to what the user granted.

The identity and authorization infrastructure it has was built for a person proving they are who they say, not for a person handing scoped authority to a piece of software and later withdrawing it. That gap widens as the same agent acts for one user across many services and as the stakes of a delegated action rise.

Design challenge

Let a user grant scoped, revocable, time-bound authority to an agent.

Make sure the user, not the agent, stands behind a sensitive or irreversible action, to a degree proportionate to the stakes.

Let an agency verify that grant is real, current, and bounded without contacting the user in real time.

Keep a path open for people who can't set up or operate an agent, or who must act through a trusted person instead.

Patterns in this territory

14 shown

2.1 Frontier

Fine-grained scope negotiation

Letting a user grant an agent exactly one bounded permission (lodge this return, touch nothing else) in a form the service can enforce. If the agent misbehaves, the harm stops at the boundary of the one permission the user granted.

2.2 Frontier

Digital power of attorney

Adapting the power of attorney, the oldest instrument for scoped, revocable delegation, to a delegate that is software rather than a named person. When a delegation is disputed, agencies and users inherit a legal instrument courts already know how to read.

2.3 Frontier

Consumer data rights consent flows

Taking a user's authorization through a consent flow the user completes with the government rather than with the agent: scoped permissions, strong authentication, and a standing dashboard for review and revocation. A compromised or over-reaching agent can't use credentials it never held.

2.4 Frontier

Consent receipts and records

Giving every delegation a durable, verifiable record: what was authorized, by whom, for how long, and what was done under it. When a delegation is later disputed, the user and the agency can point to the same record of what was authorized.

2.5 Frontier

Delegation registries

A registry an agency can query at the moment an agent acts, so a delegation can be checked without contacting the user, who is usually not there.

2.6 Frontier

Binding an agent to a verified identity

Tying every delegation to a user identity verified to a known assurance level. When a delegation is challenged, the agency can trace it to a person whose identity was verified at a known level.

2.7 Frontier

Step-up re-authorization for sensitive actions

Pausing an agent at the sensitive or irreversible step and putting that one decision back in the user's hands, at a confirmation strength matched to the stakes. Routine actions proceed on the standing grant; consequential ones wait for the user.

2.8 Frontier

Nominated-agent authorization

Requiring the user to nominate the agent that will act for them, rather than letting the agent nominate itself. The nomination record lets an agency refuse any agent the user never appointed.

2.9 Emerging

User-defined access policies

Letting a user write the standing rules for their agent in advance (what it may do, when, and for what purpose) so the service can grant or refuse access later without the user present. A request outside the rules is refused by the service itself, whatever the agent claims the user wanted.

2.10 Frontier

Healthcare delegation

Delegation for the highest-stakes government decisions, the kind that can't be undone once acted on, borrowed from healthcare proxies and advance directives. Services making irreversible decisions get a delegation model medicine has already tested at those stakes.

2.11 Frontier

Managed agent identity

An identity layer for the agent itself, so a relying agency can prove who authorized it, check what it may do, and stop it. An agency can confirm an agent's authority, or end it, without asking the user to understand the protocol underneath.

2.12 Frontier

Duress-resistant delegation

Testing that a user's grant of authority to an agent is freely given, not coerced: porting the anti-duress safeguards of fiduciary regimes into the digital delegation flow, proportionate to the stakes of the delegated action.

2.13 Frontier

Containing a compromised agent

When a user's delegated agent is hijacked, spoofed, or tricked into acting beyond its scope, containing it: cutting off the agent's standing authority before the harm compounds.

2.14 Frontier

User-set machine-readable terms

Letting a person state their own terms for how their data and interactions are handled, in a machine-readable form chosen from a neutral roster, so that a service (and the agents on both sides) can read the terms, agree to them, and keep a shared record of the agreement.

Case studies that touch this territory

Case study

An agent lodges a return

A scenario following one person who authorizes an agent to lodge her annual tax return, and the subsequent interactions: from a question about eligibility to a disputed assessment. Each step shows how a pattern resolves in sequence, and how they depend on each other.

Informs T1 · Provenance & IntentT2 · Delegation & AuthorizationT3 · Accountability & AuditT7 · Representation & EquityT8 · Verification & Certification