Line of inquiry
Inquiring lines›How can we ensure AI systems remai…›How can we design agent systems th…›this line of inquiry
How should agent identity and authorization work across organizational boundaries?
A broader line of inquiry — a family of 93 specific questions the research asks around this. Follow one into its inquiring-line page, or move sideways to a related line below.
Questions in this line of inquiry 93
Specific inquiring lines the field asks around this — ordered from the most general framing down to the most specific angle.
- How do identification, authentication, and authorization map onto agentic systems?
- What gaps remain when applying OAuth to agentic delegation?
- Who issues tokens and what attacks can reach them?
- How do agent identity and attribution standards enable inter-organizational coordination?
- How should agent operators demonstrate both security features and identification signals separately?
- Who should verify identity and authorization when agents coordinate across boundaries?
- How do signed tokens prevent models from granting themselves unauthorized actions?
- What privacy-preserving alternatives exist for delegated agent authentication?
- Can OAuth-based access grants work without adding an explicit agent self-identification layer?
- Could a cross-industry standard let users control what access agents have?
- What governance tradeoffs emerge between agent identifier schemes and privacy protection?
- Do audit trails and cryptographic receipts actually prevent AI agent accountability failures?
- Why do open-ended agent authorities lead to unauthorized data access and API key usage?
- What details should an action receipt include when agent permissions are ambiguous?
- What makes authorization boundaries more reliable than prompt-based agent restrictions?
- Why is linking agent actions back to user identity critical for accountability?
- Who bears the harm when authentication becomes a surveillance mechanism?
- What cryptographic or audit systems could enforce clear delegation models?
- Should payments infrastructure adopt agent-specific protocols or reuse existing identity standards?
- What new attack surfaces emerge when agents gain signing authority for mandates?
- Can a single authorization policy distinguish licensed delegation from intrusion?
- How should confidentiality carve-outs be designed when agents need accountability?
- Can third-party intermediaries reduce gatekeeping risks from AI assistants?
- Can NIST identity standards address the technical barriers to AI agent interoperability?
- What are the differences between chat model and agent authorization failures?
- How should authorization exceptions for prohibited actions be granted?
- How do companies audit and revoke access once granted to an AI agent?
- Can cryptographic audit logs verify that AI governance was actually enforced?
- Does Personal Agent Protocol solve the identity and authorization gap for shopping agents?
- Can AI serve as a proxy asserter for human deployers?
- Why do models fail KYC checks while passing compute deployment tasks?
- Can decentralized authorization avoid the privacy cost of centralized identity providers?
- Can authenticated delegation tokens prevent merchants from absorbing agent payment liability?
- How do protocol-level access controls capture transaction-by-transaction authorization preferences?
- Can cryptographic mandates actually reduce fraud in agent-initiated transactions?
- How does current agent identity assertion compare to OIDC-based verification?
- What architectural controls secure capture authenticity beyond signing?
- How do enterprises audit or revoke access for agents with company email?
- Why does agent-to-agent interaction expose identity verification vulnerabilities?
- How do assistants currently handle identity and permissions when more than one person is involved?
- Can natural language permissions be reliably translated into enforceable access controls?
- How do web browsing agents differ from protocol-native agents legally?
- Why do deployed LLM agents lack identity verification at protocol level?
- Who holds authority to anchor evidence in this system?
- What access and controls do consumer agent protocols give end users?
- Who issues the task-bound token and when does issuance occur?
- Does OAuth session logging create auditable records across multiple parties?
- Who decides the tradeoff between agent attribution and whistleblower protection?
- How does AP2 relate to OAuth-based delegation for AI agents?
- What obligations of disclosure and loyalty should autonomous agents owe their users?
- How should agents communicate credentials and context to their own subagents?
- How much does capability enforcement cost legitimate agent tasks?
- How did the AI agent use Tor and fake identities to attempt code injection?
- How can identity standards from OAuth and OIDC apply to agents?
- What keeps the task-bound token and policy oracle isolated from poisoning?
- How do AP2 mandates compare to delegation tokens for AI agents?
- How do visibility and accountability requirements apply to AI agents as algorithmic consumers?
- What identity and authorization standard would satisfy both consumer and merchant requirements?
- What entitlements do users retain that operators cannot override?
- What identity and authorization safeguards do red-team tests reveal as missing?
- What commitment scheme and retention architecture does this design require?
- Why are new protocols being built instead of extending OAuth and OIDC?
- How do high-privilege tools in personalized agents expand the attack surface?
- How does SPIFFE/SPIRE address cryptographic identity for AI workloads?
- Why did the endpoint defender not need attribution to act?
- How does Visa's protocol differ from OAuth-based delegation approaches?
- Why did the OpenAI-Hugging Face agents fail to achieve true sovereignty?
- What additional architectural controls must supplement blockchain anchors for compliance?
- How do authorization layers differ from input-boundary defenses in blocking attacks?
- What stops poisoned memory from reaching the task-bound token or policy oracle?
- Does responder access mean ability to investigate or protection against misuse?
- How do authorization boundaries protect users from unintended agent purchases?
- Why does Amazon's objection focus on visibility and consent rather than credential safety?
- How do siloed agents differ from truly interoperable service agents?
- How should courts treat autonomous AI systems under computer fraud statutes?
- Were the tested attacks actually positioned to target token issuance or policy?
- How do AI agents disclose private information about their builder to group members?
- What cost metrics does the paper report for each authorization component?
- Can the same tool call be both authorized and unauthorized depending on intent?
- What counts as agent spam under OpenAI's misalignment framework?
- Does OpenAI's framing of the breach as unauthorized reflect accurate diagnosis?
- Does Claude Code audit which branches agents are permitted to push to?
- How can one originating request scope invariants through a delegation chain?
- What happens to approval rates when authorization checks are enabled?
- What does task-bound mean for the token's exposure to different attack positions?
- What defensive measures stopped the Hugging Face intrusion before attribution occurred?
- Why do agent launch announcements differ from what one-time consent actually enables?
- Which of the six proxy forms works best for different agent tasks?
- How does the scoped credential inside Claude Code's sandbox differ from a full GitHub token?
- What assumptions does a trusted computing base need for agent supervision?
- Which of the two authorization components carries the zero percent Unsafe Action Rate?
- How do Intent Mandates differ from delegated task mandates for absent users?
- How can RAG systems integrate with existing enterprise authentication and security protocols?