Security · 2026-03-02

Agentic Identity: Scoped Digital Delegates for AI Agents

By J. W. Bouckaert

The agent identity problem

AI agents are taking actions on behalf of humans: booking meetings, managing infrastructure, processing transactions, executing code. The question is how to give an autonomous system an identity without giving it the keys to the kingdom.

Passwords do not work. API keys are too broad and rarely scoped. OAuth tokens expire unpredictably and are rarely sender-constrained. The NIST AI Risk Management Framework and the OWASP Top 10 for Large Language Model Applications both flag overly broad agent privileges as a primary failure mode. For a deeper exploration of how runtime trust scoring narrows that surface, see Delegating Identity to AI Agents with Trust-Scored Scopes.

Digital delegates

PasskeyBridge introduces digital delegates: scoped, time-bound identity credentials for AI agents. Each delegate is:

Scoped—issued with a list of up to 20 scope strings. When the list is set, a request for a scope outside it is refused and recorded as a scope violation.
Time-bound—an optional expiry of up to one year, checked on every verification request.
Auditable—every verification, refused ones included, is recorded as delegate activity, and trust and scope changes are written to the append-only audit trail.
Revocable—instant revocation via the admin dashboard or API, or automatic suspension on compromise signals.

Lifecycle

Issuance

A tenant admin creates a delegate via the dashboard or API. The agent receives a scoped credential: a randomly generated, high-entropy agent token, of which PasskeyBridge stores only the SHA-256 hash. The raw token is never stored, and it is shown once, at creation.

Authentication

When the agent makes a request, it presents its credential. PasskeyBridge verifies the hash against the stored delegate record, checks scope permissions, validates expiration, and records when the delegate was last used.

Parametric revocation

When a hard signal (SIM swap, port-out, device compromise, SS7 intercept, account takeover) arrives on a live API key, PasskeyBridge deactivates every active delegate in the tenant and sets its trust score to zero before any playbook action runs. This applies to the whole tenant, including delegates issued by other users. Passkeys stay registered and social recovery does not start from the signal, as SIM-Swap Detection on Its Own sets out. Ingest does not send a CAEP event when it suspends delegates; a CAEP stream is configured separately.

Behavioral trust scoring

Beyond static scope, agent privileges narrow at runtime when behavioral signals drift. We covered the model in Trust Decay Functions and Agent Behavioral Drift and the cross-agent protocol in A2A Trust Negotiation.

Integration with the three pillars

Pillar I feeds compromise signals that trigger delegate revocation. See The Carrier Signal Landscape in 2026.
Pillar II provides the verifiable credential framework that delegates extend.
Pillar III covers the people behind delegates: each delegate record stores the signed-in tenant member who created it.

Consequences for enterprise identity

As AI agents become first-class participants in enterprise workflows, identity infrastructure must evolve beyond human-centric models. Digital delegates give agents the minimum viable identity they need: scoped, auditable, instantly revocable, and tethered to a verifiable human principal.

No more shared API keys. No more long-lived service accounts. No more "the agent had admin and we did not realize it." Just scoped identity for autonomous systems, backed by the same security guarantees as human identities, ready for SOC 2 Type II audit controls.