Agent identity, authorisation, and delegation
Make every delegation explainable and revocable.
An agent identity should tell you who delegated the work, what actions are permitted and when that authority ends. Examine the full path from user intent to the system that enforces access.
Make every delegation explainable and revocable
- Granting principal
- The person or service entitled to delegate a bounded task.
- Agent workload
- The identity and credential used for this execution.
- Resource policy
- The system that allows or denies a specific action.
- Revocation path
- The mechanism that withdraws authority across active sessions.
Discipline model
Follow authority from the principal to the resource
The relationships that define the discipline
- Granting principal
- A mandate links the authorised person to the task being delegated.
- Agent workload
- The credential identifies the caller; it need not explain the entire mandate.
- Resource policy
- Permission checks join the requested action to the principal and resource.
- Revocation path
- Withdrawal must reach the active access paths, not only the original grant.
Authentication identifies a caller; authorisation decides what that caller may do. Delegation connects those permissions to someone entitled to grant them. A shared credential can conceal this relationship, especially when work passes between agents or tenants. The useful unit of review is a particular action on a particular resource, with its principal, mandate and enforcement path visible.
Illustrative situation
The task can end before the credential does
A constructed situation to reason through
Illustrative scenario
- Task ends
A purchasing agent completes an approved request.
- Credential persists
Its token may still permit another purchasing action.
- Review condition
Inspect expiry and revocation at the resource boundary.
Use this situation to identify the evidence that would change the decision. The proposed examination must stay within the agreed scope, and any conclusion must describe the conditions actually inspected.
Working approach
Test the permission at the enforcement point
Proposed investigation sequence
- Define granting principal
State the decision and conditions the work must address.
- Map agent workload
Connect the relevant actors, configuration and evidence.
- Examine resource policy
Use agreed evidence and controlled cases where appropriate.
- Review revocation path
Record limits, ownership and the condition for a next decision.
Begin with a consequential action and trace the identity used at every tool boundary. Compare effective permissions with the intended mandate, including expiry, approval and revocation. A policy document explains intent; configuration and authorised runtime checks examine whether the resource actually enforces it. Record places where attribution or withdrawal depends on another team.
Working artefact
An authority record should explain a single action
Illustrative working record
Illustrative working format
- Granting principal
- Define the subject and the requirement the record addresses.
- Evidence reference
- Link source, version and observed condition without copying sensitive material.
- Resource policy
- Explain the finding or choice and its consequence.
- Revocation path
- Assign the next action and state what remains unresolved.
An authority record connects the granting principal, delegated task, allowed resource and action, credential lifetime and revocation check. It should help identity and application owners find a grant that is broader or longer-lived than the task requires. Keep credential values in their approved systems; the record needs references and scope, not secrets.
Scope and next decision
Treat downstream enforcement as a dependency
Prepare a bounded next discussion
- Granting principal
- Bring one concrete workflow question and its accountable owner.
- Agent workload
- Identify the evidence and access that can be made available.
- Resource policy
- Agree the specialist involvement and responsibilities required.
- Written scope
- Confirm activities, evidence, readiness and acceptance before commitment.
Identity work needs access to the actual delegation and policy configuration. It does not establish that every downstream service enforces the same rule. Changes to identity infrastructure, transaction signing or legal mandates require their own scope and qualified owners.
Explore the discipline
Specialist areas within this capability
Choose a question to explore its methods, boundaries and indicative outputs.
- Agent identity architecture
- Workload identity for agents
- Agent credential lifecycle design
- Agent authentication review
- Agent authorisation modelling
- Delegated authority design
- User-to-agent delegation controls
- Agent-to-agent delegation controls
- Non-human identity governance
- Least-privilege agent design
- Temporary credential architecture
- Agent impersonation testing
- Identity propagation across tools
- Cross-tenant identity isolation
- Agent attribution and non-repudiation
- Authorisation policy testing
- Consent and mandate management
- Agent transaction signing
- Identity revocation testing
- Agent identity maturity assessment
Related services
Agent Release Readiness Review
The Agent Release Readiness Review is a fixed-scope, three-week independent test of one AI agent workflow that shows a release board what the agent does, what it is allowed to do and what happens when it is wrong, and ends in a signed recommendation.
AI Agent Authorisation Review
Make delegated authority inspectable. Trace who an agent acts for, what it can access and how that access can be withdrawn.
AI Agent Runtime Security Review
Make every delegation explicit. Examine who the agent acts for, where it can execute and which tools it can reach when instructions alone are not enough.
AI Agent Red Team
Challenge the boundaries that matter to your workflow. Test agreed attack scenarios against agent instructions, tools and data access.
AI Secure Agent Architecture Review
Design authority and isolation into the system. Review trust boundaries, credentials, tools and recovery before deployment choices become difficult to change.
AI Secure Agent Deployment Review
Look beyond a successful demonstration. Examine the permissions, dependencies and operational controls that shape an agent’s behaviour in deployment.
Relevant insights
Designing agent authority boundaries
Turn agent permissions into an enforceable action contract. Separate a model's suggestion from a resource owner's authorisation, test the boundary, and make delegation and revocation reviewable.
Permission-aware retrieval: the control most RAG diagrams omit
A retrieval system should establish the active principal and filter authorised resources before similarity ranking or model context assembly.
AI agents in legal operations: assistance without invented authority
Legal agents can organize evidence and prepare work, but professional judgement, client authority and verified legal positions cannot be delegated by interface.