First-class identity is not delegated authority

A distinct agent identity is a major improvement over shared API keys and borrowed user sessions. It lets systems recognize the actor, attach policy, issue short-lived credentials, record actions, and revoke one workload without disabling an entire integration. It does not answer why the agent is acting, whose authority it is exercising, or whether the current action belongs to the task that authority covered.

Google Cloud describes Agent Identity as a first-class principal distinct from human identities and generic service accounts, built on SPIFFE and usable whether an agent operates autonomously or on behalf of a user. That distinction is the foundation for agent-specific governance. The next layer must bind the principal to a mandate.

The same agent may serve many users, workflows, and organizations. Its cryptographic identity can remain constant while the delegated purpose changes. If the resource server sees only the agent principal, it may know exactly which workload connected and still lack the facts required to decide whether this request is legitimate.

Carry the mandate with the principal

A mandate can state the delegating principal, task, permitted operations, resource scope, consequence limits, issue time, expiry, and approval conditions. It should be audience-bound so a token intended for one tool cannot be replayed at another. The agent identity authenticates the actor; the mandate explains the authority being lent for this act.

Autonomous operation needs explicit institutional authority too. Saying no user is currently present does not mean the agent acts on its own legitimacy. A scheduled reconciliation may operate under a service owner's policy. A monitoring agent may act under an incident-response charter. Name that basis and its revocation path rather than treating autonomy as ownerlessness.

Identity tells the service who arrived; delegation tells it why that arrival is allowed.

Records should preserve both layers without overexposing personal identity. A pseudonymous or organizational delegator may be sufficient for the resource server while a restricted audit system retains the fuller chain. Minimize disclosure, but do not collapse the agent, operator, user, and institution into one ambiguous credential.

Revocation should work at several levels. Stop one task without disabling the agent. Disable one agent without revoking the user. Withdraw a user's delegation without breaking unrelated institutional work. Suspend an organization-wide agent class after an incident. First-class identity makes these distinctions possible; mandate design makes them meaningful.

Authorization should be checked again at the resource, not inferred from an upstream planner's decision. The planner may misunderstand the request, operate on stale policy, or be compromised by untrusted content. The resource server has the best knowledge of the requested object and effect. It should validate the agent principal, mandate, audience, current policy, and any required approval immediately before the consequential operation.

Long-running tasks complicate delegation. A mandate that was valid when research began may expire before the agent attempts a purchase, record change, or external message. Refresh should require a still-valid authority chain rather than silently extending the old task. If policy or user intent changed during the run, the agent should stop with a resumable record instead of treating elapsed time as implicit permission.

Observability should distinguish authentication failure, absent delegation, insufficient scope, expired mandate, policy denial, and missing approval. Collapsing them into access denied makes operations brittle and encourages broad credential grants as a debugging shortcut. Precise denial reasons can remain protected from untrusted callers while giving authorized operators enough evidence to fix the correct layer.

Human approval should not replace the mandate with an unbounded user token. The approval can authorize a specific prepared action, amount, destination, and expiry while the agent continues to authenticate as itself. This preserves actor attribution and limits replay. If implementation requires switching into the approver's full session, the system has converted a narrow consent event into broad impersonation and should treat that as a design defect. The audit record should show both principals distinctly.

Operate the boundary

The practical starting point is a named control for the binding between agent identity, delegating principal, task mandate, audience, and expiry. Write the boundary in terms an operator can evaluate: the initiating principal, permitted purpose, affected resources, allowed consequences, escalation path, expiry condition, and evidence produced. A policy sentence is useful context; the enforced object and its observable state are what make the policy operational.

Test the boundary by replaying a valid agent credential across users, tasks, tools, destinations, and expired mandates while verifying that only the intended combination succeeds. Preserve the starting state, the agent's route, any intervention, the final effect, and the gaps in observation. Repeat the exercise after changing a model, tool, provider, policy, or data source. A control that passed once should not silently lend its assurance to a materially different system.

The leading signal is the proportion of consequential requests authorized with both an agent principal and a current audience-bound mandate rather than identity alone. Pair it with a consequence measure so teams do not optimize the dashboard while weakening the outcome. Review both on a fixed cadence and after every material incident or migration. When the signal disappears, determine whether the risk disappeared or the instrumentation did.

The identity and resource-policy owners together should own the decision to continue, narrow, pause, or expand the workflow. The owner needs authority over the control and access to its evidence; responsibility without either becomes ceremonial. Record the decision, the evidence cutoff, the residual uncertainty, and the next review date so the claim can age honestly.

— Dispatches · Summit Cognitive