Security · 2026-03-06
Delegating Identity to AI Agents Without Delegating Trust
By J. W. Bouckaert
The trust problem
Enterprise AI adoption is accelerating. Agents process invoices, manage customer tickets, orchestrate infrastructure, and execute trades. But every agent with system access is a potential attack vector—and frameworks like the NIST AI Risk Management Framework now require organizations to govern that exposure explicitly.
The fundamental question isn't whether to use AI agents. It's how to give them identity without giving them trust.
For the foundational framework, see Agentic Identity: Scoped Digital Delegates for AI Agents.
The NF-05 philosophy
PasskeyBridge's NF-05 specification defines a trust model for autonomous identity delegates based on three principles:
- Minimum viable identity—Agents receive the narrowest possible scope for their task
- Behavioral trust scoring—Trust is earned through consistent, predictable behavior, not granted at issuance
- Graduated scope narrowing—Anomalous behavior triggers automatic scope reduction ahead of any revocation
This is a fundamental departure from the binary model (access/no-access) that most identity systems use today, and it aligns with the least-privilege scoping primitives being formalized in OAuth 2.1.
Behavioral trust scoring
Every digital delegate in PasskeyBridge carries a trust score between 0.0 and 1.0. The score is computed by the Agent Trust Engine based on behavioral signals:
- Velocity analysis: Is the agent making requests at an unusual rate?
- IP rotation detection—Is the agent's network origin changing unexpectedly?
- Scope utilization patterns—Is the agent suddenly using scopes it rarely accessed before?
- Temporal consistency—Is the agent active outside its normal operating window?
- Error rate monitoring—Is the agent generating an unusual number of failed requests?
The trust score updates continuously. Every action the agent takes feeds the scoring model.
Graduated scope narrowing
When an agent's trust score drops, PasskeyBridge doesn't immediately revoke the delegate. Instead, it narrows the scope:
- Score ≥ 0.7—Full access: all originally granted scopes remain active
- Score ≥ 0.4—Read-only: write operations are suspended, read scopes remain
- Score ≥ 0.2—Verify-only: the agent can verify its own identity but take no actions
- Score < 0.2—Automated revocation: the delegate is suspended and the delegating user is notified
This graduated response prevents false positives from causing operational disruption. A temporary velocity spike doesn't kill a production agent—it constrains it until behavior normalizes.
Deterministic overrides
Some signals are too critical for graduated response. When PasskeyBridge's Pillar I signal ingest detects a hardware compromise or SIM swap affecting the delegating user, all delegates are immediately suspended regardless of trust score. This is the parametric revocation engine at work.
Scope restoration
If a narrowed agent's behavior returns to normal, its trust score recovers naturally. When the score crosses back above the threshold, scopes are automatically restored to their original configuration. The narrowing event, duration, and restoration are all logged to the append-only audit trail for SOC 2 compliance.
Integration with the three pillars
- Pillar I—Carrier signals trigger deterministic overrides; playbook actions can include delegate suspension
- Pillar II—Delegates can be issued as verifiable credentials, enabling cross-platform trust verification
- Pillar III—The delegating human's biometric binding via WebAuthn ensures that only authorized users can create, modify, or restore delegates
The case for enterprises now
As Reg S-ID compliance extends to agentic workflows, enterprises need to prove that autonomous systems operated within authorized boundaries. The risks are catalogued explicitly in the OWASP Non-Human Identities Top 10, which identifies overprivileged service accounts, secret sprawl, and missing behavioral controls as the dominant failure modes. PasskeyBridge's trust scoring and scope narrowing provide the audit evidence regulators require—every trust score change, every scope narrowing event, every restoration is logged.
The alternative is shared API keys with no behavioral monitoring, no scope enforcement, and no audit trail. In 2026, that's not just risky—it's negligent.