Overview
Enterprise AI agents can reason, use tools, delegate, and act across resources, so borrowed human credentials obscure the actor and the authority chain. This series separates identity, authentication, authorization, delegation, sessions, scopes, and enforcement, then builds a human-rooted authorization envelope that extends existing access policies without replacing them. It applies the model to untrusted content and prompt injection, and weighs formal guarantees against synthetic benchmark results. The evidence supports conditional design feasibility, not a finished standard, universal performance, or coverage of untrusted external agents.
Learning outcomes
- Distinct agent identities preserve attribution without granting agents independent ownership of human permissions.
- Authorization should intersect human permission, a valid delegation path, and a current session or scope.
- Tool calls need current policy enforcement; content and agent messages cannot create authority.
- Formal proofs and synthetic benchmarks support conditional feasibility, not production security or universal performance.
Keywords
Preview every chapter · Unlock full text, audio, and video from chapter 4
PlansFAQ
Why should an AI agent have its own identity?
An AI agent should have its own identity when it can reason, delegate, and cause actions across enterprise resources, so policy and audit can distinguish the software actor from the human who initiated the task.
How can an AI agent act on behalf of a person without impersonating them?
It can act through a human-rooted delegation that names the agent, limits resources and actions, controls onward delegation, and is checked with the current session, scope, and conditions.
Can a document or prompt injection expand an AI agent’s authority?
No. Untrusted content can influence an agent’s reasoning, but it cannot create a new identity, delegation, scope, or permission at a mediated tool boundary.
Does agent governance require replacing existing access policies?
No. The proposed compositional overlay preserves the existing human permission path and adds a separate agent branch that depends on human-rooted delegation and compatible scope.
What do the formal results and benchmarks show?
The formal results provide conditional preservation and soundness guarantees, while synthetic benchmarks suggest feasible overhead under tested workloads. They do not guarantee production security or performance.