How can AI agents prove who authorized their actions?

The paper proposes "a novel framework for authenticated, authorized, and auditable delegation of authority to AI agents, where human users can securely delegate and restrict the permissions and scope of agents while maintaining clear chains of accountability." It distinguishes three concepts precisely: "authentication confirms an entity's identity; authorization determines the permissible actions and resource accesses that the authenticated identity is allowed to perform... and auditability allows all parties to inspect and verify that claims, credentials, and attributes remain unaltered." The technical core is a three-token scheme built on OAuth 2.0 and OpenID Connect: a User ID token, an Agent-ID token, and a new Delegation Token that "explicitly authorizes an AI agent to act on the user's behalf," is "issued and signed by the human delegator," and "carries references to (e.g., hash of) the corresponding user's ID token and the agent's Agent-ID token" so any service that trusts the OpenID Provider can verify it.

The reasoning draws an explicit analogy to agency law: "the law of agency addresses circumstances in which one party, the principal, authorizes another party... to act on their behalf," and a "key result of agency law is to instill trust and confidence in market transactions" by clarifying liability. The delegation token is framed as the digital equivalent of that liability-clarifying instrument — it specifies "validity conditions, such as expiration time or revocation endpoints," carries "logging or audit URLs," and is "digitally signed by the user to prevent forgeries and ensure that the user knowingly granted the AI agent the listed privileges." The paper frames this explicitly as operationalizing the EU AI Act's "human-in-the-loop" requirement: "third parties can firmly establish when, how, and under what conditions the AI is authorized to act," rather than delegating "behind opaque layers of code." A companion mechanism translates "flexible, natural language permissions into auditable access control configurations," distinguishing "task scoping" from "resource scoping" so a plain-language instruction becomes an enforceable permission set.

This gives a concrete protocol-layer answer to the gap Why do agents fail at identity verification and authorization? names: where that note's red-teaming evidence shows agents and non-owners cannot be reliably distinguished in conversational context, the delegation token moves identity and authorization out of manipulable context files and into a cryptographically signed, externally verifiable credential. It also supplies a transfer mechanism for the authority dimension that What makes delegation work beyond just splitting tasks? treats as one of eleven task-characteristic axes: that note analyzes what should be delegated and under what conditions, while this framework specifies how the delegation itself is authenticated, scoped, and revoked once a decision to delegate has been made. And it names a candidate owner for the governance gap left open in Who enforces invariants when agents cross organizational boundaries? — the human delegator who signs the token, and the OpenID Provider both parties trust — at least for identity and authorization claims within a single delegation chain.

The excerpt is a proposed framework, not a deployed or evaluated one: no service provider, model vendor, or regulator is shown adopting it, and the paper's own list of "key research directions" (standardized scope definitions, privacy-preserving delegation, provider tooling) signals these remain open. It also only anchors a single delegation chain from one human principal to one agent; it does not address how trust propagates when that agent sub-delegates to or negotiates with another organization's agent, leaving the cross-organization invariant-ownership question open. The framework's own discussion of its limitations flags a further cost of this design — see Do OpenID Providers gain surveillance power over AI agents?.