AI agents need delegated identity—not inherited API keys

A reusable API key can show that a caller possesses a credential. It usually says much less about why a particular software agent holds it, which person or organisation remains accountable, whether another agent may inherit it or which task justified the grant. When the same secret moves across tools, the operating record becomes a chain of possession rather than a chain of authority.

Agent identity begins by making the non-human actor explicit. The agent has its own identifier and credential, while the grant records the principal from which its authority derives. That distinction supports attribution without pretending that an automated action was a human authentication event.

Delegation allows an actor to exercise a bounded part of another authority while preserving the actor relationship. Impersonation presents the subject as if the intermediary were absent. RFC 8693 treats those as different semantics; the distinction matters because an investigator and a policy engine need to know both who owns the authority and who exercised it.

A sound mandate therefore carries enough context to answer two questions at once: whose authority is this, and which agent is acting now? Removing either answer weakens accountability. Adding both does not, by itself, make the agent trustworthy; it makes the decision reviewable.

Least privilege for an agent is not simply a smaller role name. The mandate should identify the permitted capabilities, intended audience, expiry, re-delegation depth and relevant operating constraints. An empty or unresolved grant should confer nothing. A child grant should never become wider merely because a new credential was minted.

Audience restriction is especially important. A credential intended for one resource should not become portable authority for another. RFC 9700 reinforces the wider OAuth security principle that access tokens should be restricted to the minimum privileges and resources needed, with replay risk considered as part of the design.

Issuance is only the beginning. Operators need to narrow a mandate, suspend an agent, revoke a credential, rotate a key and retire an identity without waiting for every issued token to age out unnoticed. A resource that relies only on old embedded claims may continue to honour authority that the source has already withdrawn.

The difficult question is where current state is checked. Connected systems can resolve status at decision time; disconnected systems may have only an earlier snapshot. The architecture should state that boundary plainly instead of using a global kill-switch metaphor that cannot hold across a network gap.

An agent programme should preserve the grant, the actor relationship, the relevant policy decision and the lifecycle events that changed authority. It should not indiscriminately record prompts, payloads or private data simply because they are available. Evidence is useful when it can reconstruct the decision while respecting purpose and retention limits.

For evaluation, ask a supplier to demonstrate a deliberately invalid child grant, an expired credential, the wrong audience, a replay and a revoked link. A successful happy path shows that an agent can act. These refusal paths show whether delegated identity actually bounds the action.