The identity and delegation chain

The chain

In short: An agentAgent. Software that uses an AI model to work toward a goal on its own: it reads, decides the next step, uses tools, and keeps going until the job is done or a limit stops it. acts as the person who asked, and that claim must survive every hand-off from one system to the next.

foundation · flow

Identity follows the delegation chain

Every consequential action must identify the agent, requesting person, sponsor, and granted scope.

Mixed evidence

1. 1

   Sponsor

   Owns purpose and risk.

2. 2

   Requesting user

   Supplies authority for this task.

3. 3

   ID2 production identity

   First-class IAM principal with task scope, audit, and named sponsor.

4. 4

   Policy decision

   Checks scope and context.

5. 5

   System of record

   Makes final entitlement decision.

6. 6

   Evidence record

   Binds action to the full chain.

Diagram description: Delegation chain from accountable sponsor and requesting user through an individually registered agent identity to policy enforcement and the system of record. The sequence contains 6 stages: 1, Sponsor: Owns purpose and risk.; 2, Requesting user: Supplies authority for this task.; 3, ID2 production identity: First-class IAM principal with task scope, audit, and named sponsor.; 4, Policy decision: Checks scope and context.; 5, System of record: Makes final entitlement decision.; 6, Evidence record: Binds action to the full chain..

Reviewed 2026-08-20·Sources:Identity and security model

Hop 1: the agent's own identity (the ID2 floor). Every agent is a first-class principal: an account in its own right. This guide calls that minimum ID2. It means the agent is registered, holds least privilegeLeast privilege. Giving an agent only the access its current task needs, and taking it back when the task ends. (only the access its current task needs), uses short-lived credentials, and carries a named sponsorSponsor and owner. The sponsor is the business person accountable for why an agent exists. The owner is the technical person who keeps it configured and secure. and a risk tier. Sharing a human's credentials is the ID1 anti-pattern. The baseline is bad: non-human identities outnumber human ones by roughly 100 to 1, and 97 percent of them hold more access than they need. Three families of workload identityWorkload identity. Proof of who a piece of running software is, issued by the platform rather than typed in as a password. The machine equivalent of an ID badge. (the machine equivalent of an ID badge) are in production. Directory-based: the Entra Agent ID class. Standards-track: the IETF WIMSE architecture, where IETF is the Internet Engineering Task Force and WIMSE stands for Workload Identity in Multi System Environments. In that family, SPIFFE (Secure Production Identity Framework for Everyone) already runs for agents in production at scale. OAuth-extension based, where OAuth is the standard web protocol for delegated access. The example is Cross App Access (XAA), adopted as the Enterprise Managed Authorization (EMA) extension of the Model Context Protocol (MCP)MCP (Model Context Protocol). An open standard for connecting agents to tools and data, like a universal plug. An MCP gateway is the governed version of that plug.. It had 25 or more independent software vendors (ISVs) behind it by mid-2026.

Hop 2: delegation at the gateway. The gatewayGateway. The single door every agent request passes through on its way to a tool or model. Because everything goes through it, it is where rules are enforced and activity is recorded., the single door every agent request passes through, exchanges the caller's identity rather than copying it. The mechanisms are token exchangeToken exchange (on-behalf-of). Swapping one credential for another so an agent acts with the permissions of the person who asked, not with its own broader powers. under the internet standard RFC 8693, on-behalf-of flows, and XAA in its EMA form. The IETF ID-JAG draft (Identity Assertion JWT Authorization Grant) joins them as it lands. The gateway injects credentials at execution time, so agents never hold secrets. Access above a minimal baseline is granted just in timeJust-in-time access. Access granted for a short window when it is needed, then withdrawn automatically. for a single action, using OAuth Rich Authorization Requests (RAR, RFC 9396), and drops back automatically afterwards.

Hop 3: run-as-user in the system of record. Inside the business system the agent operates run-as-userRun-as-user. Making the agent operate inside a business system exactly as the requesting person would, with that person's permissions, so nothing is visible or changeable that the person could not see or change.: it is the requesting person, with that person's permissions and nothing more. The toolTool. A function an agent can call to do something real: look up a record, send an email, run a query. Tools are where agents touch your systems. layer is a wrapper, not a second policy engine. The system of record keeps its own create, read, update, and delete (CRUD) rules, its field-level security, and its sharing rules in force. Its audit log attributes the action to the human identity. Vendor parity statements now make this explicit: if the user cannot do something in the platform, their agent cannot do it through the tool server.

Hop 4: constrained identities at the edges. In operational technology (OT)OT (operational technology). The systems that run physical equipment: plants, grids, vehicles. Safety rules keep AI out of the control loop., the systems that run physical equipment, the agent is a security principal with least privilege. Assets without a registered name are not reachable on the network, and access can be cut in seconds. Sub-agents inherit a narrower scope than their parent, never a wider one, and the stated purpose travels with each delegation.

Sponsor at access identity, presence by exception

In short: Every agent carries a named accountable person on its access identity; giving it a mailbox is a separate, rare decision.

The accountable human sponsor is an attribute of the agent's access identityAgent identity. A registered account for an agent with a named owner, limited permissions, and credentials that expire, so every action can be traced to who asked., not a reward for giving it a mailbox. Platform architectures carry the sponsor field on the service principal itself, the agent's own directory account. Agents can be named and mentioned in chat and collaboration tools without any user account. Presence is different. It means a mailbox, a calendar seat, licence consumption, a place in the human resources (HR) system, or a seat on a meeting roster. Presence is a separate, optional, one-to-one user account, granted by an administrator and revocable. It is decided per capability surfaceCapability surface. Everything an agent can actually do: which systems it can read, write, send from, or appear in. Controls are chosen from this list, not from the product's name., meaning per thing the agent could actually do, and only for a small set of long-lived agents. Being nameable is not the same as having presence.

support · comparison

Accountability is not enforcement

A named sponsor answers for purpose and outcomes; a deterministic control prevents or permits the action.

Accountability

• Named human sponsor
• Purpose and outcome ownership
• Exception and appeal responsibility

Enforcement

• Deterministic policy decision
• Permission at the gateway
• Allow, deny, limit, or stop

Diagram description: Side-by-side distinction between human accountability for purpose and outcomes and technical enforcement of permissions at the action boundary. The comparison contains 2 groups: Accountability, containing Named human sponsor, Purpose and outcome ownership, Exception and appeal responsibility; Enforcement, containing Deterministic policy decision, Permission at the gateway, Allow, deny, limit, or stop.

Reviewed 2026-08-20·Sources:Identity and security model

Accountability is also not enforcement. A named sponsor answers for purpose and outcomes. A deterministicDeterministic. Always gives the same answer for the same input by following fixed rules. The opposite of probabilistic, where the answer can vary. control, one that follows fixed rules and always gives the same answer, permits or prevents the action. In testing, a promptPrompt. The instructions and information given to the model for a task. A prompt is advice to the model, not a control on it. from a phished employee asking an agent to send credentials out of the company succeeded in 24 of 25 attempts. The name on the agent stopped nothing. Both are necessary; neither substitutes for the other.

Operational floor

In short: You must be able to switch any agent off fast, from more than one place, and know from drills how long it takes.

The time it takes to revoke one agent's credentials is a drilled, measured number. Kill switchesKill switch. A guaranteed way to stop an agent immediately, built at more than one point so that one failure cannot disable it. exist in the identity system as well as in the runtimeAgent platform. The software that runs agents: the runtime, the harness, the list of approved agents, and the rules for how they start, stop, and change., the gateway, and the harnessHarness. The engineering shell around the model: what goes into its working memory, which tools it can call, when it must stop, how much it may spend, and how it recovers when something fails. (the engineering shell around the model). Each covers what the others cannot. Policy engines fail closedDegraded mode. What a system does when a part fails. For agents, that means falling back to a human queue rather than guessing.: if the engine fails, the answer is no. Only a minority of enterprises have a formal agent identity strategy. The chain above is what one looks like.

The research behind this page

• The identity and security model
• Security and identity findings
• Productivity and collaboration findings