Identity, Delegation, and Auditability for AI Agents with Production Access

Abstract

Software agents based on large language models are also moving from programming proof-of-concept works to production work, reading telemetry, carrying out runbooks, mutating configuration, and calling infrastructure-level interfaces on behalf of engineering teams. The models used to govern these new agents were constructed for other actors. In contrast, while humans will be held accountable for their reviews, service accounts, assuming a known and fixed principal, can have their behaviors easily scoped ahead of time. The same cannot be said for agents. It is also broad in capability, nondeterministic, and the goals it learns are dependent on natural language inputs that an opponent might influence. Instead of inventing new solutions here, this work considers the exposure as a familiar problem at an infrastructure scale. In addition to permission scoping based on resources, this paper argues that such scoping is structurally insufficient, as all resources are involved in both trivial and catastrophic behavior. This paper also proposes bounded delegation, an agent credential that derives from the authority of the human actor, is scoped to the authority defined by the task, is valid for the duration of the task, and is gated based on the reversibility of the task rather than on which resource it touches. It explains how bounded delegation composes with production identity and authorization primitives that are in widespread use, defines autonomy retention, a metric for evaluating the compliance of other presence containment schemes, and defines an audit record of the actions of agents, allowing an agent's reasoning and authority to be reconstructed after the fact.