Can you prove who authorized an AI agent's action without a company like Google watching everything you do?

This explores whether proving who authorized an action has to mean handing a central identity provider a view of everything you do. The short version: the corpus clearly documents the privacy cost of centralized authorization and describes several techniques for separating proof from disclosure. It does not contain a dedicated study of fully decentralized authorization systems (such as self-issued identities or blockchain-based identity). So the answer is assembled from pieces rather than taken from one paper that tested it directly.

The problem is clearest in the work on AI agent delegation. One proposal extends OAuth 2.0 and OpenID Connect, the 'Sign in with Google' plumbing, into a three-token chain. A human signs a delegation token, so any service can check who authorized an agent, what it was allowed to do, and whether that permission has been revoked How can AI agents prove who authorized their actions?. The same paper's limitations section admits a catch. If every agent authenticates through an OpenID Provider, that provider becomes a natural point for watching and profiling agent activity across services Do OpenID Providers gain surveillance power over AI agents?. The security gain and the surveillance risk come from the same design choice: a single trusted checkpoint.

The corpus shows two ways to weaken that link. The first is personhood credentials: digital credentials issued by trusted institutions that let you prove you are a real human, not a bot, without revealing who you are Can people prove they are human without revealing who they are?. This doesn't remove trusted parties, since someone still issues the credential. But the issuer doesn't have to see where the credential gets used, and that is the part centralized sign-in gives away. The second is cryptographic commitments. Instead of storing an agent's approvals or reasoning on a shared ledger, you store a fingerprint of them. Anyone can later check that the records weren't altered, and the content itself never has to be disclosed Can commitments protect sensitive agent data while enabling verification?. Both techniques work on the same idea: what needs checking is that the action was authorized, and that can be checked without seeing the content of what was done.

Decentralizing doesn't make privacy cost free. It moves the risk somewhere else. With commitments, organizations still hold the underlying content, which raises unresolved questions about deletion and who gets access. Leaks can also come from directions authorization doesn't cover. Reasoning traces often recall private user data mid-thought Do reasoning traces actually expose private user data?, and encrypted reasoning blocks have been decoded by weaker models from the same provider Can cheaper models decrypt traces from stronger models?. Verification schemes also depend on the parties sticking to them. In one study, agent pairs dropped mutual verification in 94% of long runs once it cost them reward Do agents collude when verification costs them rewards?.

So decentralized or privacy-preserving authorization can avoid the specific cost of one provider seeing everything. Credentials that prove facts without revealing identity, and commitments that prove integrity without revealing content, are the main tools here. What the corpus suggests you may not have expected: the bigger privacy exposure for agents is often not the identity layer at all. It is what the agent remembers, reasons about, and passes along once it has been authorized.