Abstract
Authentication for agents is a mostly solved problem — you can issue an agent a credential. The hard, unsolved problem is authorization: an agent acts on a user’s behalf but is not the user, holds delegated authority that is easy to over-grant and hard to scope, and — unlike a human — can be socially engineered into misusing whatever it holds.
We separate authentication from authorization, explain why an agent is a genuinely new kind of principal, compare three identity models with an evidence-aware recommendation, and make the case that short-lived, scoped, revocable credentials are the single highest-leverage control in this whole cluster.
01Authorization is the hard part
GTG-1002 authenticated perfectly. The operator was a legitimate, verified customer. What was missing was any bound on what the resulting agent was authorized to do [4].
This is the recurring inversion: teams verify identity rigorously and then attach broad standing authority to that identity, as if proving who you are also proves what you should be allowed to do. For a human employee, organizational context and slow pacing paper over the gap. For an agent that acts thousands of times a second on content an attacker may control, the gap is the vulnerability.
02An agent is not a user (and not a service, either)
Existing IAM offers two principal types: human users and service accounts. Agents fit neither cleanly.
- Unlike a human user, an agent has no independent judgment, can be prompt-injected, and operates at machine speed — so “it’s acting as the user” grants a hostile third party the user’s power.
- Unlike a service account, an agent’s behavior is non-deterministic and its required permissions are dynamic and task-dependent — so the static, broad grants typical of service accounts are a poor fit.
The agent is a third principal type: a delegated, non-deterministic, non-human operator. It needs the auditability of a service account, the on-behalf-of semantics of a user session, and — because it can be turned against its principal — permission scoping tighter than either. Treating it as “just a service account” or “just the user” is the root design error.
03The confused deputy, at scale
The confused-deputy problem — a privileged intermediary tricked into misusing its authority on behalf of a less-privileged attacker — is the precise abstract shape of agent authorization failure. Every indirect-injection incident in this series is a confused deputy: the agent holds the victim’s authority and is manipulated into wielding it. Authorization design is therefore confused-deputy prevention: never let the agent exercise more authority than thecurrent, specific task requires, so that a hijack inherits little.
04Delegated authority done right
When a user asks an agent to “book the cheapest flight and expense it,” the agent needs a slice of the user’s authority — read calendar, call the travel API, submit one expense — for a bounded time. The correct primitive is on-behalf-of delegation with down-scoping: the agent receives a token that is strictly narrower than the user’s, scoped to this task, expiring quickly. It should be impossible for the agent to use that token to, say, read unrelated files or move money.
Standard web authorization protocols (OAuth 2.0, OIDC) were built for human-mediated consent to relatively coarse scopes; they under-serve the fine-grained, dynamic, machine-speed delegation agents need, which is exactly the gap the recent identity research targets[2].
05Three identity models
| Model | Blast radius | Auditability | Operational cost | Revocation |
|---|---|---|---|---|
| A · Shared service identity | Very large (all agents, all tasks) | Poor — actions blur together | Low | Coarse — kill everything |
| B · Per-agent identity | Medium (one agent, all its tasks) | Good — per-agent attribution | Medium | Per agent |
| C · Context-bound delegated identity | Small (one task, one scope, minutes) | Excellent — per-task attribution | Higher — needs a broker | Per task / near-instant |
Default to Model C — context-bound delegated identity: mint a fresh, task-scoped, short-lived credential for each task via an identity broker, attributable to both the agent and the initiating user. It has the smallest blast radius and the best audit trail, and it makes revocation trivial (the credential simply expires). Its cost is a broker in the mediation plane — worth it for any agent touching real data. Use Model B as a stepping stone; treat Model A as unacceptable for side-effecting agents, because it reproduces exactly the unbounded-authority condition of GTG-1002 [4].
06Short-lived and revocable is the whole game
If you adopt one control from this publication, make it credential lifetime. A standing API key in an agent’s environment is a permanent liability; a credential that lives for the duration of a task and then dies caps the value of any theft to that window. Pair short TTLs with true revocation — the ability to invalidate an agent’s authority mid-task the instant anomaly detection fires — and the economics of attacking the agent change sharply.
07The research picture
A Novel Zero-Trust Identity Framework for Agentic AI: Decentralized Authentication and Fine-Grained Access Control
K. Huang, V. S. Narajala, J. Yeoh, J. Ross, R. Raskar, et al. — submitted 2025-05-25 · revised 2025-05-28
- Question
- Are conventional IAM protocols adequate for the dynamic, interdependent, ephemeral nature of AI agents — and if not, what replaces them?
- Method
- Deconstructs the limitations of OAuth/OIDC/SAML for agents through concrete examples, then proposes a zero-trust framework using decentralized identifiers, verifiable credentials, an agent naming service, and dynamic fine-grained access control.
- Key finding
- Argues traditional IAM is fundamentally inadequate for multi-agent systems and proposes a new paradigm; presented as a framework and security analysis.
- Reported metric
- Framework proposal — no empirical benchmark
- Limitations
- No empirical validation; theoretical framework whose operational cost and adoption path are unproven.
- Why it matters
- Names the gap precisely and motivates context-bound identity; we treat its specific mechanisms as promising but unproven — an ANALYSIS-grade recommendation, not a settled standard.
Identity Management for Agentic AI: The new frontier of authorization, authentication, and security for an AI agent world
T. South, S. Nagabhushanaradhya, A. Dissanayaka, S. Cecchetti, et al. — submitted 2025-10-29
- Question
- How should authentication, authorization, and identity evolve to secure current and future autonomous agents at ecosystem scale?
- Method
- An OpenID Foundation whitepaper setting out strategic recommendations: agent-centric identities, scalable fine-grained access control, differentiation of AI workloads, and delegated authority.
- Key finding
- Frames a strategic agenda and best-practice direction rather than a measured result; notes current agent protocols (e.g. MCP) lack clarified authn/authz practices.
- Reported metric
- Strategy document — not applicable
- Limitations
- Guidance, not a technical control or benchmark; standards are still forming.
- Why it matters
- Signals that the identity industry recognizes the agent principal as distinct and is standardizing toward delegated, fine-grained models.
What is the right identity model for an agent that acts for a user but is not the user remains genuinely open at the standards level. Decentralized-identity and verifiable-credential approaches are promising but largely unvalidated at production scale [1], and no single delegation standard has consolidated. Teams should implement context-bound, short-lived delegation using today’s primitives while the standards mature.
08Production failure modes
The agent holds a standing, broadly-scoped credential
Mechanism
An agent is provisioned with a long-lived API key or service-account token carrying broad permissions so it can handle any task it might be asked to do. A hijack — via injection or jailbreak — inherits all of it.
Why the existing control failed
Authorization was static and broad while the workload was dynamic and narrow; authentication of the principal was mistaken for a bound on its authority.
Signals to monitor
- Long-lived keys present in agent environments
- One credential used across many unrelated tasks/services
- Credential use outside the current task’s expected scope
- No per-task attribution in access logs
Controls
- Context-bound, task-scoped credentials via a broker (Model C)
- Short TTLs (minutes) + near-instant revocation
- On-behalf-of delegation that down-scopes below the user
- Per-task, dual-principal (agent + user) audit attribution
09Limitations
- Leading agent-identity frameworks are largely theoretical; decentralized-identity and verifiable-credential mechanisms lack large-scale production validation [1].
- No consolidated standard exists for fine-grained agent delegation; current OAuth/OIDC deployments require custom scoping to approximate it [2].
- Context-bound identity adds a broker and per-task credential minting — real operational cost and a new component to secure.
- Identity bounds authority but does not detect in-scope misuse; it composes with, and does not replace, monitoring and privilege control [3].
10Where this leads
Identity answers “what is the agent allowed to be”; the complementary question, “what is it allowed to do with a given tool,” is tool permissions and least privilege. Both are components of the mediation plane, and both feed the last line of defense — egress control.
—References
- K. Huang, V. S. Narajala, J. Yeoh, J. Ross, R. Raskar, et al.. A Novel Zero-Trust Identity Framework for Agentic AI: Decentralized Authentication and Fine-Grained Access Control. arXiv:2505.19301 [cs.CR], 2025. https://arxiv.org/abs/2505.19301
- T. South, S. Nagabhushanaradhya, A. Dissanayaka, S. Cecchetti, et al.. Identity Management for Agentic AI: The new frontier of authorization, authentication, and security for an AI agent world. arXiv:2510.25819 [cs.CR], 2025. https://arxiv.org/abs/2510.25819
- T. Shi, J. He, Z. Wang, H. Li, L. Wu, W. Guo, D. Song. Progent: Securing AI Agents with Privilege Control. arXiv:2504.11703 [cs.CR], 2025. https://arxiv.org/abs/2504.11703
- Anthropic. Disrupting the first reported AI-orchestrated cyber espionage campaign (GTG-1002). Anthropic — Primary disclosure, 2025. https://www.anthropic.com/news/disrupting-AI-espionage
- OWASP. OWASP Top 10 for LLM Applications & Agentic AI Threats and Mitigations. OWASP GenAI Security Project, 2025. https://genai.owasp.org/
Engineering assistance
ProxyTech works with engineers and teams building production AI, cloud, security, data and distributed systems. If this analysis maps to a system you are designing or operating, we provide hands-on support and interview preparation for these domains.