Authenticated Delegation and Authorized AI Agents

The rapid deployment of autonomous AI agents creates urgent challenges around authorization, accountability, and access control in digital spaces. New standards are needed to know whom AI agents act on behalf of and guide their use appropriately, protecting online spaces while unlocking the value of task delegation to autonomous agents. We introduce a novel framework for authenticated, authorized, and auditable delegation of authority to AI agents, where human users can securely delegate and restrict the permissions and scope of agents while maintaining clear chains of accountability. This framework builds on existing identification and access management protocols, extending OAuth 2.0 and OpenID Connect with agent-specific credentials and metadata, maintaining compatibility with established authentication and web infrastructure. Further, we propose a framework for translating flexible, natural language permissions into auditable access control configurations, enabling robust scoping of AI agent capabilities across diverse interaction modalities. Taken together, this practical approach facilitates immediate deployment of AI agents while addressing key security and accountability concerns, working toward ensuring agentic AI systems perform only appropriate actions and providing a tool for digital service providers to enable AI agent interactions without risking harm from scalable interaction.

Introduction. Agentic AI systems, also referred to as AI assistants or simply ‘agents’, are AI systems that can pursue complex goals with limited direct supervision on behalf of a user [33, 22, 72, 21, 45], including by interacting with a variety of external digital tools and services [55, 47, 32]. For example, AI agents given a prompt to book travel arrangements for a holiday may browse the web for recommendations, search for flights via APIs, or message an airline agent in natural language via chat services to arrange a booking. Such communications could even extend to AI agent negotiations [1] and other multi-agent contexts.

While current AI agents have limitations [67, 86], lack the ability to perform certain tasks [49], and may be susceptible to attacks such as prompt injections [91, 50, 95], there has been rapid progress in their development and commercial interest.

This has raised many concerns over the risks of AI agents and how they should be governed [72, 33, 27]. Credentials and verification may become critical in verifying the properties and metadata of AI systems [22], uniquely identifying humans in online spaces [14] (or at least distinguishing humans from AI agents [3]), protecting contextual confidence [42], mitigating AI-augmented influence operations [37], preventing AI manipulation of humans [8, 74], and governing or auditing AI systems more broadly [68, 75]. The world needs ways to explicitly delegate authority to agents, transparently identify those agents as AI, and enforce humancentered choices around security and permission for these agents.

We distinguish three key concepts: authentication confirms an entity’s identity; authorization determines the permissible actions and resource accesses that the authenticated identity is allowed to perform, defining the scope and limitations of delegated activity; and auditability allows all parties to inspect and verify that claims, credentials, and attributes remain unaltered, supporting trustworthy authentication and authorization decisions.

This work has three key contributions. First, section 2 builds upon the existing literature to outline why authenticated delegation is important for AI agents, and what risks it could mitigate. In doing so, we provide an overview of current practices and where they fall short. Second, section 3 directly addresses this need by extending existing authentication and authorization protocols to enable authenticated delegation to AI agents, examining the role OpenID

Related work. Comparisons to other AI identifiers To verify human identity online, a large body of work exists ranging from simple authentication such as OAuth 2.0 [41] to more complex digital identity frameworks as W3C’s Verifiable Credentials [78], decentralized identifiers [77], and the European Union Digital Identity’s privacy-preserving digital wallets [85]. To privately prove personhood, a number of systems have been developed to distinguish human users from bots, including proof-of-personhood systems designed to counter automated Sybil attacks [15], simple turing tests such as CAPTCHAs [81], and more robust credentials [3]. More generally, the goal of ‘know-your-customer’ for users and granular access permissions (identity and access management, IAM) are commonplace on the internet.

Comparisons to Model Context Protocol and GPT Actions One example of an AI-centric protocol is the recent Model Context Protocol (MCP) [6] from Anthropic, which enables secure, structured interactions between AI systems and external tools or data sources. MCP aims to enhance the contextual relevance of AI outputs by establishing a standardized framework for connecting models to resources to facilitate applications like retrieving live data, interacting with APIs, and executing tasks in real time.

Similarly, OpenAI’s GPT Actions are integrations allowing GPT models to perform specific actions like booking a flight or retrieving data from APIs, which is a more constrained version of MCP and shares in its shortcomings. LangChain’s Agent Protocol / LangGraph Platform extends this idea to enable multi-agent interoperability.

How authenticated delegation combines these solutions This work combines and extends these existing approaches— AI agent IDs and credentials, proof-of-personhood and identity verification for human users, and content provenance and watermarking methods—to form a cohesive framework. This approach inherits well-established practices for identity management while introducing explicit scoping and metadata for AI agents. This integration allows for granular, enforceable permission sets, clearer accountability chains, and richer context signals (like a model’s certifications or limitations) to be attached to each delegated action, with a more robustly verifiable construction than a simple agent ID system card. In effect, authenticated delegation complements existing standards and enhances their reliability by anchoring the actions of AI agents to verifiable human principals and recognized AI-specific credentials, creating a unified foundation for safe and accountable AI interactions. To this end, section 3 introduces a concrete framework with additional security guarantees to package these elements together in a robustly verifiable way.

Method. 3. Extending OpenID Connect for identifying and authenticating AI agents To support the motivation of section 2, this section proposes a concrete technical framework building on existing internet-scale authentication protocols to introduce mechanisms for delegating authority from users to AI agents and describes a token-based authentication framework that leverages OpenID Connect and OAuth 2.0. Our approach extends these battle-tested protocols to address the unique challenges of AI agent authentication while maintaining compatibility with existing internet infrastructure.

OAuth 2.0 emerged from the need for users to provide authorization to one service to access resources located in another service, based on the RESTful paradigm [30]. A key requirement underlying OAuth 2.0 is the ability for access to be continually granted even if later the user is absent (e.g., offline). Existing user authentication protocols (e.g., MIT Kerberos [57], CHAP [73]) were developed primarily for the interaction between a human user utilizing a host computer connecting to the authentication server over the UDP layer. The advent of the RESTful APIs meant that the parameters and flows had to be communicated over the 3.2. Delegation of authority from the user to the AI agent Next, the human user can issue a new delegation token that authorizes the AI Agent to carry out tasks on behalf of the user. Here, the term ‘authorize’ is utilized to explicitly call out the fact that the AI Agent is owned (driven) by a human delegator.

Client Human User 3.3. Token-based authentication framework • Delegation Token: This newly introduced token explicitly authorizes an AI agent to act on the user’s behalf. The delegation token is issued and signed by the human delegator and carries references to (e.g., hash of) the corresponding user’s ID token and the agent’s Agent- ID token, allowing it to be verified by any service that trusts the OP. Further, any relevant information about the nature of the delegation can be shared. For example, sharing the summarized goal of the agent and its scope limitations could assist a third party in guiding the AI agent to useful endpoints and interaction paradigms. The delegation token should specify validity conditions, such as expiration time or revocation endpoints, and be digitally signed by the user to prevent forgeries and ensure that the user knowingly granted the AI agent the listed privileges. In addition, the token may carry supplemental metadata—for example, logging or audit URLs—allowing service providers to record interactions, monitor delegated actions, and respond appropriately to anomalies. By verifying that the delegation token references a valid user ID-token and a properly issued agent ID-token, remote services can confirm the authenticity and scope of the AI agent’s authority before granting access.

We distinguish between task scoping and resource scoping:

4.4. Combining structured permissions, natural language, and user oversight

Discussion. Model vendors (e.g., OpenAI, Anthropic, Google) can provide tooling to share which user is being represented when an AI system accesses a digital service and what the intended scope or permissions are. This is encouraged. However, current approaches to sharing such information are insufficient from a security and verifiability perspective, such as including the information in the user-agent string of the AI system, or writing the information into API calls made by the AI system. Instead, these services could act as an OpenID Provider (or partner with one) for the AI system without any change to the user experience, or if they prefer a different instantiation of the authenticated delegation framework, they could provide W3C verifiable credentials paired with robust, unique IDs for AI agents and users.

The law of agency addresses circumstances in which one party, the principal, authorizes another party, the (human) agent, to act on their behalf [34]. At its core, agency law determines when a principal may be held liable for the acts of their agent, ensuring that third parties are not unfairly disadvantaged by having to ascertain who holds ultimate responsibility.

A key result of agency law is to instill trust and confidence in market transactions: by providing clear rules about liability and authority, agency law reduces uncertainty and contributes to more efficient market operations [66, 89, 20].

A critical element of both trust and accountability in AIaugmented systems lies in maintaining meaningful human oversight, often termed the “human-in-the-loop” requirement. The EU AI Act, for example, emphasizes the importance of maintaining human involvement in high-risk AI decisions to ensure ethical, transparent, and accountable outcomes [27]. The authenticated delegation framework supports this principle by making the human role in agent workflows explicit. Rather than delegating authority to an AI system behind opaque layers of code, third parties can firmly establish when, how, and under what conditions the AI is authorized to act. This allows humans to step in to verify decisions, correct errors, and ensure that automated actions remain aligned with overarching legal and ethical standards.

Conclusion. This paper presents a practical framework for authenticated delegation to AI agents, addressing urgent challenges around authorization, accountability, identity verification, and access control management in digital spaces. By extending existing OAuth 2.0 and OpenID Connect protocols with AI-specific credentials and delegation mechanisms, our approach enables secure delegation of authority from users to AI agents while maintaining clear chains of accountability. The proposed token-based framework - comprising user ID tokens, agent-ID tokens, and delegation tokens - provides a robust foundation for verifying agent identities, controlling permissions, and maintaining audit trails, while supporting granular and robust scope limitations generated in response to natural language instructions. Our key contribution is demonstrating how established internet-scale authentication (e.g., OpenID Connect and W3C VCs) and access management protocols (e.g., XACML) can be adapted to address the unique challenges of AI agent delegation while preserving compatibility with current systems, as illustrated through real-world use cases in areas like automated negotiations and web service interactions. As AI agents become more prevalent in digital spaces, frameworks like this will be essential for ensuring they operate within appropriate bounds while remaining accountable to their human principals. Looking ahead, key research directions include developing standardized scope definitions for common AI agent tasks, exploring privacy-preserving delegation mechanisms, and creating tools to help service providers implement and manage agent authentication policies, ultimately working toward ensuring AI systems can be safely and productively integrated into existing digital infrastructure.

Limitations. Overhead from multiple sign-in flows. A significant drawback of the OpenID Connect approach is the potential overhead introduced by multiple sign-in flows required to authorize AI agents across individual service providers. This can be likened to the experience of setting up a new email client, where users must repeatedly log in to authorize access to various services. While such authorization flows enhance security by ensuring each provider independently verifies the AI agent’s delegation credentials, they impose a usability cost by slowing down access to secure systems. In theory, it is possible to bypass this burden by presenting delegation tokens directly without performing the full OIDC authentication flow; however, this shortcut sacrifices key security guarantees, particularly those related to token freshness and verification.

Increased reliance on OpenID Providers and privacy risks. The reliance on OpenID Providers (e.g., Google, Facebook, or equivalent entities) introduces systemic privacy concerns. Since OIDC providers mediate all authentication flows, they gain the ability to track and correlate individual AI agent interactions across various services. This can include collecting statistical usage analytics or requiring relying parties to share logs, which facilitates extensive behavioral profiling.