Every agent action should answer who is acting, for whom, with which authority, and through which chain

Separate the identities in the chain

Do not collapse the user, application, agent, service account, and tool into one identity. Each has different lifecycle, assurance, privilege, and accountability properties.

• Human or organizational principal
• Client application or workload identity
• Agent definition and version
• Ephemeral run or task identity
• Delegated grant or capability
• Tool, server, and downstream service identity
• Approver and effect verifier

Authentication is not authorization

Authentication establishes an identity or credential. Authorization decides whether that identity may perform the specific operation now. The model should never infer permission solely from a tool being visible.

Use task-scoped delegation

A delegation should state purpose, permitted actions, resources, data class, time, value or quantity limit, environment, downstream delegation rule, and revocation. Research on authenticated delegation proposes agent-specific credentials and auditable chains compatible with established web identity patterns. [S1]

Attenuate authority at every hop

A delegated actor should not be able to widen the original scope. A research agent permitted to read one case should not create a sub-agent with organization-wide search. A proposal agent allowed to draft should not grant execution authority to a tool.

MCP authorization and enterprise management

MCP's HTTP authorization model uses OAuth-based protected-resource patterns, and current enterprise-managed authorization work aims to let organizations centrally control approved server access. These mechanisms help establish transport and resource access; they do not replace task-specific business policy, data classification, or effect approval. [S2] [S3]

Record the authorization decision

Retain principal, agent and version, task, requested capability, resource, policy version, decision, reason, grant, expiry, tool call, effect verification, and reviewer. Avoid retaining sensitive payload content when structured identifiers are sufficient.

Support revocation and incident response

Revocation should work independently of the model and preferably independently of the agent runtime. Disable the grant, tool gateway, workload credential, or queue and preserve durable state for reconciliation.

Common failures

Ambient credentials, confused deputy behavior, identity loss across delegation, shared service accounts, overbroad scopes, stale grants, policy text interpreted as authority, and audit records that omit the human principal are recurring failure patterns.

Research boundary

Identity and delegation standards for agents are evolving. This article describes architecture principles rather than declaring one universal identity scheme. Implementation requires current protocol, IAM, security, privacy, and platform review.