PaperlayerView exact revision on arXiv

Source-linked AI summary

Authenticated Delegation and Authorized AI Agents

Tobin South, Samuele Marro, Thomas Hardjono, Robert Mahari, Cedric Deslandes Whitney, Dazza Greenwood, Alan Chan, Alex Pentland

arXiv:2501.09674v1cs.CYcs.AIcs.NI

TL;DR

Autonomous AI agents need stronger authorization, accountability, and access control when they interact with personal accounts, sensitive data, or consequential infrastructure. The paper proposes authenticated, authorized, and auditable delegation by extending established identity protocols with agent credentials, scoped permissions, and approval flows. Its framework combines structured and natural-language controls to support fine-grained, auditable delegation, while recognizing attack and usability limitations.

  • Problem

    More robust delegation frameworks are needed to control AI agents accessing personal accounts, sensitive information, and consequential infrastructure.

  • Method

    The framework extends OAuth 2.0 and OpenID Connect with agent credentials and metadata, and translates natural-language permissions into auditable access-control rules with dynamic user approval.

  • Results

    The proposed token-based framework supports verifying agent identities, controlling permissions, maintaining audit trails, and generating granular scope limitations while remaining compatible with existing systems.

  • Takeaways & Limitations

    Combining structured policy, natural-language interaction, and user oversight anchors agent behavior and record-keeping in auditable, deterministic controls.

  • Takeaways & Limitations

    Natural-language policies remain vulnerable to prompt injection and jailbreak attacks that can produce policies exceeding the user’s intent.

Abstract

from arXiv · show

The rapid deployment of autonomous AI agents creates urgent challenges around authorization, accountability, and access control in digital spaces. New standards are needed to know whom AI agents act on behalf of and guide their use appropriately, protecting online spaces while unlocking the value of task delegation to autonomous agents. We introduce a novel framework for authenticated, authorized, and auditable delegation of authority to AI agents, where human users can securely delegate and restrict the permissions and scope of agents while maintaining clear chains of accountability. This framework builds on existing identification and access management protocols, extending OAuth 2.0 and OpenID Connect with agent-specific credentials and metadata, maintaining compatibility with established authentication and web infrastructure. Further, we propose a framework for translating flexible, natural language permissions into auditable access control configurations, enabling robust scoping of AI agent capabilities across diverse interaction modalities. Taken together, this practical approach facilitates immediate deployment of AI agents while addressing key security and accountability concerns, working toward ensuring agentic AI systems perform only appropriate actions and providing a tool for digital service providers to enable AI agent interactions without risking harm from scalable interaction.

1. Introduction

AI agents can pursue complex goals and interact with external services, but their rapid deployment raises governance, identity, authorization, and accountability concerns. The paper proposes extending established authentication and authorization infrastructure with authenticated delegation and auditable, fine-grained agent permissions.

  • Agentic AI and its risks: AI agents pursue complex goals with limited supervision and interact with external digital tools and services.Examples include browsing, API-based flight searches, messaging, negotiations, and other multi-agent interactions.
  • Agentic AI and its risks: Current agents have limitations and may be vulnerable to prompt injections and other attacks, despite rapid development and commercial interest.These vulnerabilities motivate stronger governance and delegation mechanisms.
  • Agentic AI and its risks: Credentials and verification can identify AI systems and humans, preserve contextual confidence, mitigate manipulation, and support broader AI governance and auditing.The paper frames explicit delegation of authority as part of this broader verification need.
  • Core concepts: Authentication establishes identity, authorization defines permitted actions and resource access, and auditability enables inspection of claims, credentials, and attributes.Together, these concepts support trustworthy delegation decisions.
  • Paper contributions: The framework extends OpenID Connect and OAuth 2.0 for authenticated delegation to AI agents while preserving a pragmatic, robust, and extensible implementation.It also explores translating natural-language permissions into auditable, fine-grained rules across web requests, computer use, and language interfaces.
  • Paper contributions: Verifiable delegation credentials contain agent identity and properties, scoped permissions, user metadata, and cryptographic signatures.These fields support verifiability, traceability, and appropriate delegation of authority.

2. Why authenticated delegation is important

Authenticated delegation lets third parties verify that an AI agent represents a specific human and has permission to perform specified actions. The paper motivates this framework across consequential tool use, agent collaboration, and human online spaces, combining identity, credentials, explicit scoping, and auditability.

  • Definition and scope: Authenticated delegation enables third parties to verify an agent’s identity, human principal, and permissions for specific actions.It applies when agents access tools, the web, computer environments, digital services, or other agents.
  • Delegating authority: Consequential uses such as personal accounts, sensitive information, and infrastructure require stronger delegation frameworks than simple tool use.The need grows as language models become more autonomous and general-purpose.
  • Delegating authority: Providing credentials or prompts alone cannot reliably constrain agents because prompts have failure modes, tool blocking lacks granularity, and deployer controls may not reach interacting services.A flight-purchase example highlights risks from unexpected actions, attacks, or jailbreaks.
  • Delegating authority: Authenticated delegation can attach agent limitations and capabilities to authority, reducing risks when systems operate with incomplete modalities or broad account access.A telemedicine example describes a text-only agent diagnosing from records that include unavailable video information.
  • Multi-agent interactions: Mutual authentication is needed when agents collaborate so each can verify the users or organizations represented and reduce impersonation and unauthorized actions.The paper illustrates this with hospital and insurance agents processing a patient claim.
  • Human online spaces: Combining verified human identity with authenticated delegation can support human-only spaces while allowing controlled, accountable agent access.The framework is presented as a way to avoid blanket exclusion of useful agent proxies and representatives.
  • Integrated framework: Some existing approaches support system communication or constrained actions but do not cover the full scope of authorized delegation, identity management, and access control.This limitation motivates combining and extending those approaches.
  • Integrated framework: The proposed framework combines agent credentials, personhood and identity verification, provenance, explicit scoping, and metadata to create verifiable accountability chains.It adapts established identity and access-management practices while adding context such as model certifications or limitations.

3. Extending OpenID Connect for identifying and authenticating AI agents

The framework extends OAuth 2.0 and OpenID Connect with agent registration, identity tokens, and delegation tokens so users can authorize AI agents through existing infrastructure. It also supports centralized policy management and explicit scope limitations for delegated actions.

  • Protocol foundation: The framework builds on OAuth 2.0 and OpenID Connect to delegate authority from human users to AI agents while remaining compatible with existing internet infrastructure.It uses established authentication and authorization patterns rather than replacing them.
  • Policy management: OIDC and UMA can support centralized policy configuration across multiple AI agents, with policies propagated from one authorization server to distributed agent resources.This model is suited to users who manage multiple agents and want a single point of policy control.
  • Delegation flow: Users authenticate to an OpenID Provider, register an AI agent as their delegate, and issue a delegation token authorizing specified tasks on their behalf.The proposed flow separates user authentication, agent registration, and task authorization.
  • Open questions: Further formalization is needed for integrating W3C Verifiable Credentials with OpenID-based issuance and delegation mechanisms.The paper identifies this interoperability work as future work beyond its scope.
  • Token-based authentication: The token framework distinguishes user identity, agent identity, and delegated authority through a user ID-token, an Agent-ID token, and a Delegation Token.The Delegation Token links the user and agent tokens and can carry information about the delegation’s goal and scope.
  • Scope limitations: Delegation tokens can encode explicit action boundaries, but defining scope remains challenging because agents have flexible and diverse action spaces.The framework treats scoping as a distinct design challenge rather than assuming ordinary fixed-resource permissions are sufficient.

4. Defining scope and permissions for AI agents

AI-agent permissions must bridge flexible task instructions and precise, auditable resource controls. The proposed approach combines structured permissions, natural-language interfaces, authentication flows, and human oversight to constrain agents across environments and modalities.

  • Natural language and oversight: Natural-language permissions can express broad agent action spaces, but should be translated into machine-readable, version-controllable, auditable rules rather than enforced solely by an LLM.This translation addresses misinstruction, prompt injection, ambiguity, and reduced security auditability.
  • Scope dimensions: Task scoping specifies authorized actions, whereas resource scoping specifies the information, APIs, and tools an agent may use or modify.The two forms are connected because restricting tasks limits necessary resources, while restricting resources constrains feasible tasks.
  • Inter-agent scoping: The framework extends scoping across modalities and inter-agent settings by propagating limitations and producing auditable records of operations and accessed resources.In multi-agent interactions, a receiving agent can interpret the delegator’s scope in its own environment and verify that assigned operations remain within it.
  • Structured permissions: Structured policy languages are precise for resource scoping but less flexible for open-ended tasks, potentially becoming complex and environment-specific.Their drawbacks are especially pronounced when resources and possible web interactions are numerous.
  • Authentication flows: Authentication flows dynamically request approval for borderline or high-risk operations, complementing static policies without requiring users to specify every edge case.A combined design automates routine checks while escalating novel or ambiguous requests, though frequent prompts can cause prompt fatigue and misclassification.
  • Structured permissions: Structured permissions provide the primary enforcement mechanism for constraining AI-agent resource access.They are machine-readable, deterministic, and auditable, enabling system-level enforcement such as read-only directory access.

5. Discussion

The discussion identifies trade-offs in the OIDC-based authenticated-delegation framework, including usability, privacy, and complexity costs. It also highlights risks in natural-language policy translation, third-party enforcement, and adapting legal accountability to autonomous agents.

  • Problems with an OpenID Connect approach: Multiple OIDC sign-in flows improve provider-level verification but slow authorization across services; bypassing them sacrifices token freshness and verification guarantees.The paper presents this as a security–usability trade-off.
  • Problems with an OpenID Connect approach: OIDC providers can correlate agent interactions across services, creating centralized surveillance and behavioral-profiling risks that require privacy mitigations.Pairwise pseudonymous identifiers and reduced log sharing are proposed, but add complexity.
  • Discussion: The framework offers an interoperable path by extending existing protocols, but further work is needed on privacy, legal foundations, and human oversight.The discussion also notes self-hosted deployments can integrate internal identity and permission controls.
  • Limitations of natural language scoping: Natural-language permission translation can misinterpret ambiguous instructions, while human review may miss subtle errors as policy complexity increases.The challenge concerns alignment between the user’s wording and the generated machine-readable policy.
  • Limitations of natural language scoping: Prompt injection and jailbreak attacks may induce policies that exceed user intent, even when scoping instructions are separated from ordinary interactions.Language-based policy interfaces introduce threats absent from purely static access control.
  • Limitations of natural language scoping: Policy maintenance becomes difficult when instructions, resources, or task contexts change, and third-party enforcement can become a critical security failure point.The framework therefore faces both contextual-drift and enforcement-dependency boundaries.

6. Conclusion

The conclusion presents authenticated delegation as a practical extension of established identity and access-management infrastructure for accountable AI-agent use. It combines agent-specific credentials, delegation tokens, and auditable scope controls while identifying standardization and privacy as future priorities.

  • 6. Conclusion: The framework extends OAuth 2.0 and OpenID Connect with AI-specific credentials and delegation mechanisms to secure authority transfer from users to agents.It is designed to preserve compatibility with current authentication infrastructure.
  • 6. Conclusion: User ID tokens, agent-ID tokens, and delegation tokens support identity verification, permission control, audit trails, and granular scope limits derived from natural-language instructions.The framework adapts OpenID Connect, W3C Verifiable Credentials, and XACML for agent delegation.
  • 6. Conclusion: The framework is intended to keep agents within appropriate bounds while preserving accountability to their human principals.The conclusion frames this as essential as agents become more prevalent in digital spaces.
  • 6. Conclusion: Future research includes standardized scope definitions, privacy-preserving delegation, and tools that help service providers manage agent interactions.These directions address remaining deployment and governance needs identified by the paper.

A.1. Federated OpenID Providers for Agent Mutual Authentication

The appendix describes federated mutual authentication in which agents present credentials and their providers validate claims across domains. It also distinguishes local and global identifiers and reuses OAuth 2.0 and OIDC structures for scalable agent identity and threat mitigation.

  • Federated mutual authentication: Agents mutually authenticate by presenting Agent-ID and delegation credentials, allowing each party to verify the other’s delegated authority.Figure 4 illustrates the process in a federated environment.
  • Federated mutual authentication: A1 presents a Verifiable Credential to A2; OpenID Providers validate claims and authenticate across domains through federation.OP1 verifies A2’s credentials by communicating with A2’s home-domain OP2.
  • Agent identifiers: Local identifiers distinguish agent instances within a domain, whereas global identifiers support references and interactions across the Internet.A local identifier may require mapping to a global identifier outside its originating domain.
  • Agent identifiers: Mapping global identifiers to local identifiers lets home-domain systems authenticate and support agents while retaining scalable cross-domain references.Global identifiers may also be incorporated into decentralized identifiers for DLT-based services.
  • OAuth 2.0 integration: Reusing OAuth 2.0 client identifiers and secrets provides a practical basis for recognizing previously registered AI-agent clients.The proposal builds on identifier structures already used by authorization servers and OpenID Providers.
  • Threat model: The proposal targets threats including token authenticity failures, identity tampering, spoofing, correlation, and session hijacking.OIDC mechanisms such as pairwise pseudonymous identifiers and session management are discussed as mitigations.

B.1. Schema Validation As Scoping

Schema validation scopes agents by constraining outputs to predefined structured formats, enabling deterministic compliance checks and structured auditing. Its main limitation is reduced flexibility for nuanced or evolving tasks, whereas controlled natural languages offer a middle ground.

  • Schema validation: Schema validation constrains agent outputs or queries to predefined formats such as JSON, XML, or RDF.Rules can restrict permissible classes, properties, relationships, predicates, or other structured elements.
  • Schema validation: Structured outputs allow non-AI systems to verify compliance deterministically and simplify logging because actions are captured in structured form.This can make validation simpler than parsing unstructured text.
  • Limitations: Rigid schemas can reduce flexibility for nuanced or creative tasks, especially when requirements evolve over time.Designing a schema that is expressive and safe also requires substantial effort.
  • Schema validation: Schema validation is particularly powerful for resource scoping when permissible actions can be codified in structured formats.Its usefulness depends on whether the action range can be represented safely and expressively.
  • Alternatives: Controlled Natural Languages preserve some natural-language readability while improving suitability for automated parsing and formal verification.They are presented as a middle ground between structured permission languages and unrestricted natural language.

C. Example Use Cases

Four scenarios illustrate how authenticated delegation supports secure and accountable AI-agent interactions through credentials, scoped permissions, and accountability mechanisms.

  • C. Example Use Cases: The scenarios cover different AI-agent interactions while retaining a common delegation structure.Each example illustrates delegation credentials, scoping mechanisms, and accountability.
  • C. Example Use Cases: Delegation credentials identify the delegating party and agent while defining permitted scope.
  • C. Example Use Cases: Scoping mechanisms restrict agent behavior to authorized actions and resources.

C.1. AI Agent for Web Browsing

The web-browsing scenario delegates scheduling, information retrieval, and payments to an agent while restricting websites, actions, and transaction amounts. Credential validation blocks unauthorized activity, and logs preserve traceability.

  • C.1. AI Agent for Web Browsing: The agent performs scheduling, information retrieval, and online-payment tasks within specified websites and action limits.
  • C.1. AI Agent for Web Browsing: The delegation credential records user identity, agent identity and capabilities, approved websites, permitted actions, spending limits, and validity duration.
  • C.1. AI Agent for Web Browsing: Websites validate the credential and automatically block unapproved sites or transactions exceeding predefined limits.
  • C.1. AI Agent for Web Browsing: Logs linked to the agent’s unique identity record transactions and actions for post-interaction review and traceability.
  • C.1. AI Agent for Web Browsing: The structured credential protects sensitive user data and preserves user control over online interactions.

C.2. API-Only Data Manager

The API-only data-manager scenario lets an agent aggregate and analyze internal data through restricted, read-only API access. Credential validation denies unauthorized operations, while token rotation and logging support security and accountability.

  • C.2. API-Only Data Manager: The agent aggregates and analyzes internal operational or inventory data through specified APIs and nondestructive actions.
  • C.2. API-Only Data Manager: The credential identifies the delegating organization or individual and agent purpose while specifying APIs, read-only access, rate limits, and expiration.
  • C.2. API-Only Data Manager: APIs validate credentials and deny attempts to write data or access restricted endpoints.
  • C.2. API-Only Data Manager: Delegation tokens are periodically rotated or updated to reduce risks from stale credentials.
  • C.2. API-Only Data Manager: Restricted scope prevents unintended data alteration or access, while detailed logs support accountability and rapid responses to anomalous behavior.

C.3. Remote Virtual Environment via SSH

The remote-environment scenario confines an agent to specified commands, directories, and time limits. Server enforcement rejects unauthorized operations, and credential-linked command logs support post-task review.

  • C.3. Remote Virtual Environment via SSH: The agent runs simulations or processes data within specified commands and directories in a remote virtual environment.
  • C.3. Remote Virtual Environment via SSH: The credential identifies the user and agent role while limiting directories, commands, and operating time.
  • C.3. Remote Virtual Environment via SSH: The server rejects unauthorized actions such as modifying configuration files or accessing sensitive directories.
  • C.3. Remote Virtual Environment via SSH: The environment logs each agent-executed command through its unique delegation credential for post-task review.
  • C.3. Remote Virtual Environment via SSH: Restricted delegation keeps the agent within its assigned scope and safeguards the environment against unintended or malicious actions.

C.4. Agent-to-Agent Collaboration

The framework enables two AI agents with distinct roles and permissions to collaborate through credential-validated requests. Scoped credentials, cross-agent verification, and interaction logs keep collaboration secure and accountable.

  • Scenario: Two collaborating agents can divide a complex task while respecting distinct roles and permissions.The scenario assigns logistics to one agent and finances to the other.
  • Delegation Credentials: Delegation credentials identify the user, each agent's role and capabilities, and permitted task scopes.Logistics permissions can include booking and scheduling, while financial permissions include payment processing with explicit budget constraints.
  • Collaboration Mechanism: Each agent includes its credential when sending requests to the other for cross-agent verification.Actionable requests use natural language but reference credentials for validation.
  • Auditability: Interaction logs containing credential references provide an auditable record of tasks and decisions.The audit trail covers all agent interactions.
  • Why It Matters: Embedding scoping rules in cross-agent interactions keeps collaboration secure and accountable.Predefined limits reduce the risk of unintended actions or miscommunications.
Loading 2501.09674v1…