Agent identity and delegation design

What it is for

Many agents still run on a shared API key or a long-lived service account with broad rights. When something goes wrong, no one can say which agent did it, for whom, or why it was allowed to. AG2 designs agent identity before that happens.

What we look at

• The principal model: when an agent acts on behalf of a person, and when it acts as its own principal with a named human sponsor.
• Token flows: how authority passes from the user to the agent to each tool, and where it is narrowed.
• Scopes: a catalogue of the scopes each agent may hold, with step-up for privileged actions.
• Lifecycle: how agent identities are created, reviewed, rotated and retired.
• Conditional access: the conditions under which an agent may act at all.

Where the field is

NIST’s National Cybersecurity Center of Excellence published a concept paper on agent identity and authorization on 5 February 2026, proposing to show how existing identity standards can secure AI agents.^⁠[1] CoSAI’s Agentic Identity and Access Management paper, version 1.0 of 20 March 2026, proposes managing agents as distinct, short-lived, auditable identities with access that tracks delegation.^⁠[2] The major clouds now ship agent identities, for example Microsoft Entra Agent ID, now generally available,^⁠[3] and the Agent Identity API on Google’s Gemini Enterprise Agent Platform, in preview since June 2026.^⁠[4] OWASP lists the risk as ASI03 Identity and Privilege Abuse.^⁠[5]

What you receive

A principal model for each agent, documented token flows, a scope catalogue, sponsor and lifecycle rules, and a conditional access policy your identity team can implement.