Why can't AI agents prove who they are or who sent them — and why can't better AI models fix that?
Why do deployed LLM agents lack identity verification at protocol level?
This explores why today's LLM agents usually can't prove who they are or who authorized them, and why the fix seems to belong in the plumbing (protocols and infrastructure) rather than in smarter models.
This explores why deployed LLM agents usually can't prove who they are or who sent them, and why the answer seems to sit in the plumbing rather than in the model. Red-teaming and NIST's 2026 initiative point to the same three gaps. An agent's identity lives in context files that can be edited or manipulated. Its permissions are inferred from the conversation instead of being enforced by the system. And nothing limits how far its actions can go relative to the request. Both conclude these are architectural problems that better models won't solve Why do agents fail at identity verification and authorization?. The root issue is that an LLM agent's sense of 'who I am' and 'what I'm allowed to do' is just text, and any text in the context window can be overwritten by other text.
Part of the answer is historical. Older multi-agent systems research had formal answers to these problems decades ago. BDI architectures gave agents explicit mental states, communication protocols set out who could say what to whom, and institutional models defined roles and obligations Can classical agent architectures fix agentic AI accountability?. Agent languages like KQML and FIPA-ACL gave every request a precise meaning, so a delegated task couldn't quietly grow. LLM agents replaced that with natural language, and natural language lets an agent drift out of scope. For example, an agent authorized only to query a service directly might decide on its own to query a third party Do LLM agents misinterpret delegated requests more than formal protocols?. LLM agents became flexible by dropping the formal structure that once carried identity and authority.
There's also a category error in how safety is usually applied. A model-level filter checks one output at one moment. An agent's risk is spread across its memory, the content it retrieves, its tool calls, and everything it can reach in its environment Can a model-level filter truly contain an agent with environment access?. Identity verification is the same kind of problem: it's about what the agent can touch, so it can't be solved by checking what the agent says. This fits a broader finding that reliable agents push memory, skills, and protocols out of the model and into a surrounding harness layer Where does agent reliability actually come from?. Identity and authorization are protocol burdens that haven't been moved out of the model yet.
The corpus also shows what the fix looks like. One proposal extends OAuth 2.0 and OpenID Connect, the standards behind 'Sign in with Google', with three tokens: one for the user, one for the agent, and a delegation token signed by the human. Any service can then check who authorized the agent, for what scope, and whether that permission has been revoked How can AI agents prove who authorized their actions?. Progent hands permission changes to a logic solver instead of the LLM. Each proposed policy update gets classified as a safe narrowing or a risky expansion, so a manipulated agent can't quietly give itself more privileges Can an SMT solver prevent LLM policy drift during agent execution?. OpenAI's Model Spec takes a lighter approach with ScopeOfAutonomy records that list allowed tools, cost limits, and ending conditions How can autonomous agents act safely within defined boundaries?. For auditing afterward, cryptographic commitments can prove what an agent did without exposing the sensitive content itself Can commitments protect sensitive agent data while enabling verification?.
The takeaway you might not expect: the missing identity layer isn't an oversight waiting for a smarter model. It's what we gave up when agents switched from formal protocols to natural language. The emerging fixes mostly bring back old ideas from security and multi-agent research: signed credentials, least privilege, and machine-checked rules. They run outside the model, where prompt manipulation can't reach them. The corpus covers the diagnosis and proposed designs well but has little evidence on how widely these schemes are actually deployed.
Sources 9 notes
Red-teaming and NIST's 2026 initiative converge on the same three architectural gaps: identity is stored in manipulable context files, authorization relies on conversational context instead of system-level enforcement, and agents lack proportionality constraints. These are protocol-level problems requiring architectural solutions, not model improvements.
Classical multi-agent systems research offers formal tools—BDI architectures, communication protocols, mechanism design, and institutional models—that current LLM agents lack, enabling explicit mental states and verifiable reasoning where LLMs provide only implicit, pattern-based behavior.
KQML and FIPA-ACL use formal speech-act semantics to guarantee shared understanding of requests and commitments, while LLM agents relying on natural language risk overstepping scope—such as querying third parties when only direct queries were authorized.
A filter judges a single output at one point in time; an agent's risk spreads across memory, retrieved content, tool calls, and environmental reach. Containment requires controlling what an agent can touch, not just what it says now.
Research shows reliable LLM agents externalize three cognitive burdens—memory (state persistence), skills (procedural components), and protocols (structured interaction)—into a harness layer rather than relying on model scale alone. The harness unifies these externalities and eliminates the need for the model to solve the same problems repeatedly.
Show all 9 sources
A three-token scheme (User ID, Agent ID, and Delegation Token) signed by human delegators creates cryptographically verifiable authorization chains. Services can now verify who authorized an agent, under what scope, and when revocation occurred.
Progent uses an SMT solver to verify each LLM-proposed policy update as either a safe narrowing or a risky expansion, automatically applying safe changes while blocking silent privilege escalation even when the LLM is manipulated by adversarial input.
OpenAI's Model Spec formalizes agent autonomy through structured scope records listing allowed tools, cost limits, and prohibited high-risk activities, mirroring software security's principle of least privilege while avoiding confirmation overload.
By anchoring cryptographic commitments rather than content itself, organizations can achieve tamper-evident process records while keeping sensitive communications, approvals, and reasoning traces off-chain. This separates proof from disclosure but requires organizations to retain content and raises questions about deletion and access control.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- Authenticated Delegation and Authorized AI Agents
- Securing Agentic AI: From Per-Action Checks to Trajectory Assurance
- Design Patterns for Securing LLM Agents against Prompt Injections
- Agentifying Agentic AI
- Progent: Securing AI Agents with Privilege Control
- Agents of Chaos
- Trust propagation and structural containment in Multi-agent LLM pipelines
- Explaining AI Agents Through Execution Traces