Can an AI agent prove it's acting on your behalf without exposing what you and it are actually doing?

This explores how an AI agent can prove it is acting for you without the proof itself exposing what you and your agent are doing. The short answer is that the collection describes the problem clearly but has no ready-made privacy-preserving replacement. What it does have is a few design ideas from neighbouring areas that point toward one.

Start with the main proposal. One line of work extends OAuth 2.0 and OpenID Connect, the 'Sign in with Google' plumbing, with three tokens: one identifies the user, one identifies the agent, and a signed delegation token says what the agent may do, for how long, and whether that permission has been revoked How can AI agents prove who authorized their actions?. It solves accountability well, because any service can check who authorized an action. The same paper admits the cost in its limitations section. If every agent login passes through an identity provider, that provider can watch and profile what your agents do across every service they touch Do OpenID Providers gain surveillance power over AI agents?. The security fix creates a new kind of surveillance, and a quieter one than ordinary web logins, because agents act far more often and in more places than people do.

The most promising alternative pattern appears in a different setting: tamper-proof audit trails. Instead of storing an agent's actual messages, approvals, or reasoning in a shared ledger, organizations store cryptographic commitments, short fingerprints that prove a record existed and hasn't been changed without revealing what it says Can commitments protect sensitive agent data while enabling verification?. The underlying idea is to separate proof from disclosure, and it maps directly onto delegation. A service needs to know that a valid, unrevoked authorization exists. It doesn't need the identity provider to see each use of it. The catch carries over too: someone still has to keep the underlying records, and questions about deletion and access control don't go away.

A second route is to share less in the first place. FlowMind has an LLM build workflows only from calls to vetted APIs, so the model never touches the proprietary data itself Can LLMs generate workflows without touching proprietary data?. Applied to authentication, an agent would get narrow, task-specific permissions instead of a broad identity that follows it everywhere. Work on containment makes a related point: safety comes from controlling what an agent can touch, not just from checking what it says Can a model-level filter truly contain an agent with environment access?. A permission boundary also only works when it names the specific thing being protected and is enforced through restricted tools Can explicit authorization boundaries prevent agents from modifying protected tests?. Tightly scoped credentials expose less if they leak, and they reveal less about the person behind them.

The less obvious lesson is that a clean credential system doesn't make the agent private. Agents leak information through their own reasoning: about three-quarters of privacy leaks in reasoning traces come from the model recalling sensitive user details mid-thought, and longer reasoning leaks more Do reasoning traces actually expose private user data?. Phone-agent benchmarks also show that finishing a task and finishing it in a privacy-respecting way are separate skills, and no model is best at both Do phone agents succeed at all three critical tasks equally?. Private delegation therefore needs two layers that the collection doesn't yet join up: credentials that prove authority without broadcasting activity, and agents that don't give away what those credentials were meant to protect.