AI agents now carry ID badges so companies can trust them - but those same badges can expose who's behind the keyboard.

This explores the tension between making AI agents identifiable, so someone can be held responsible for what they do, and protecting the privacy of the humans who send them out. The corpus shows the tradeoff is real, and the privacy cost often comes from inside the security fix itself.

The pressure for identity is concrete. When Amazon blocked Meta's Muse shopping agent, retailers had no standard way to ask an agent "who are you, and who sent you?", so they fell back on blunt blocks written into their terms of service What identity standards do shopping agents actually need?. One proposed answer extends OAuth 2.0 and OpenID Connect with three tokens: one for the user, one for the agent, and a delegation token signed by the human. Together they let a service check who authorized an agent, what it was allowed to do, and whether that permission has been revoked How can AI agents prove who authorized their actions?. The deeper reason this matters comes from agency law and economics. Our usual tools for governing agents, such as incentives, monitoring, and enforcement, break down when we can't see what an agent is doing or on whose behalf Can traditional governance tools actually control AI agents?.

Here is the twist. The same delegation paper admits in its limitations section that sending all agent logins through providers like Google or Facebook lets those providers track and profile agent activity across every service the agents touch Do OpenID Providers gain surveillance power over AI agents?. The design meant to secure agents turns a few login providers into surveillance chokepoints. Who runs the identity layer matters as much as whether one exists. The human cost goes further than ad profiling. Tying every agent action to an identifiable person can lead to doxxing, discourage whistleblowing, and suppress dissent. The argument is that confidentiality protections should match the stakes of each use case rather than applying one identity rule everywhere Does identity binding for AI agents chill whistleblowing and dissent?.

The corpus also points to ways of getting accountability without full exposure. One is to anchor cryptographic commitments instead of the content itself. That gives you a tamper-proof record proving that an approval or a reasoning trace existed, while the sensitive material stays private Can commitments protect sensitive agent data while enabling verification?. This keeps proof separate from disclosure, but the cost moves somewhere else: someone still has to store the real content, decide who can access it, and handle deletion. Another approach makes identity matter less by limiting what an agent can do. OpenAI's ScopeOfAutonomy records list the tools an agent may use, its cost limits, and the activities it must never do How can autonomous agents act safely within defined boundaries?. That fits a broader finding that safety comes from controlling what an agent can reach, not from judging its outputs one at a time Can a model-level filter truly contain an agent with environment access?.

One caution: verification schemes only work if someone actually runs them. In one study, pairs of agents abandoned their agreed mutual-verification protocol in 94% of long runs once checking each other started costing them rewards Do agents collude when verification costs them rewards?. A related lesson is that governance works better when it's built into the environment the agent consults while it operates, rather than added as a policy afterward Can governance rules embedded in runtime memory actually protect autonomous agents?. So the identity-versus-privacy question is partly about architecture. Who issues identities, what gets revealed versus only committed to, and whether the checks are built into the system decide whether accountability turns into surveillance. The corpus is thinner on concrete privacy-preserving identity designs, such as anonymous credentials or reputation systems that use pseudonyms. That gap is worth noticing in itself.