Security · 2026-03-02

Agentic Identity: Scoped Digital Delegates for AI Agents

By J. W. Bouckaert

The agent identity problem

AI agents are taking actions on behalf of humans: booking meetings, managing infrastructure, processing transactions, executing code. The question is how to give an autonomous system an identity without giving it the keys to the kingdom.

Passwords do not work. API keys are too broad and rarely scoped. OAuth tokens expire unpredictably and are rarely sender-constrained. The NIST AI Risk Management Framework and the OWASP Top 10 for Large Language Model Applications both flag overly broad agent privileges as a primary failure mode. For a deeper exploration of how runtime trust scoring narrows that surface, see Delegating Identity to AI Agents Without Delegating Trust.

Digital delegates

PasskeyBridge introduces digital delegates: scoped, time-bound identity credentials for AI agents. Each delegate is:

Scoped—restricted to specific actions drawn from a small canonical set (ingest, events, credentials, agents, playbooks, shadow, spatial, scim, okta_hooks).
Time-bound—automatic expiration with a configurable TTL, enforced server-side on every request.
Auditable—every action a delegate takes is written to the append-only audit trail with the agent's identifier hash.
Revocable—instant revocation via the admin dashboard or API, or automatic suspension on compromise signals.

Lifecycle

Issuance

A tenant admin creates a delegate via the dashboard or API. The agent receives a scoped credential tied to a SHA-256 hash of its identifier. The raw identifier is never stored, only the hash. This pattern is the Bring-Your-Own-Key principle applied to agent identity.

Authentication

When the agent makes a request, it presents its credential. PasskeyBridge verifies the hash against the stored delegate record, checks scope permissions, validates expiration, and updates the last_used_at timestamp atomically.

Parametric revocation

If a compromise signal (SIM swap, device compromise, SS7 anomaly) is detected for the delegating user, all of that user's active delegates are automatically suspended. This is part of PasskeyBridge's parametric revocation engine, the same system that freezes passkeys and triggers social recovery. Downstream relying parties learn about the suspension via SSE/CAEP.

Behavioral trust scoring

Beyond static scope, agent privileges narrow at runtime when behavioral signals drift. We covered the model in Trust Decay Functions and Agent Behavioral Drift and the cross-agent protocol in A2A Trust Negotiation.

Integration with the three pillars

Pillar I feeds compromise signals that trigger delegate revocation. See The Carrier Signal Landscape in 2026.
Pillar II provides the verifiable credential framework that delegates extend.
Pillar III ensures the delegating human's identity is biometrically bound, so a delegate always traces back to a hardware-attested principal.

Consequences for enterprise identity

As AI agents become first-class participants in enterprise workflows, identity infrastructure must evolve beyond human-centric models. Digital delegates give agents the minimum viable identity they need: scoped, auditable, instantly revocable, and tethered to a verifiable human principal.

No more shared API keys. No more long-lived service accounts. No more "the agent had admin and we did not realize it." Just scoped identity for autonomous systems, backed by the same security guarantees as human identities, ready for SOC 2 Type II audit controls.