When an AI agent takes charge of booking a flight, paying with a corporate card, modifying a calendar, or preparing an expense request, the issue is no longer merely the model’s ability to carry out the steps. The practical questions become: Who performed the operation? Who granted the authorization? And what are the limits of that authorization? These questions lead to two concepts whose importance is growing as agents are increasingly used at work: Agentic Identity and Delegated Authorization.
The article, written by Kippen Kobayashi as part of ITmedia’s series on emerging technologies, argues that the goal is not to make AI “trustworthy” in itself, but to build an environment in which it can be used safely even while assuming the possibility of error or deviation.
Why Isn’t a User Account Enough?
The common approach today is to provide the agent with a person’s username and password, or with that person’s browser login session, so that it operates as if it were the person. This makes execution easier, but it leaves system logs unable to distinguish between an action performed by a human and one performed by an agent. A leak of login credentials may also give an attacker the user’s full permissions, and it provides no direct way to stop only the agent.
Agentic identity proposes giving each agent an independent identity linked to the owning organization, the person responsible for it, the purpose for which it is operated, the systems it can access, and the duration of that identity’s validity. In this way, a sales-support agent and a recruiting agent are not treated as a single actor, even if they rely on the same model. A sales agent does not need access to job applicants’ files, and a recruiting agent does not need to view customer contract amounts.
Authorization Defines What Can Be Done
Delegated authorization turns the granting of permission from general approval into definable conditions: whom the agent represents, what resource or data is targeted, what type of operation is permitted, for how long, and under what restrictions. In a flight-booking example, the authorization could be limited to a ticket costing no more than 50,000 yen, the corporate card for that trip only, and changes to travel-related schedules, with the authorization expiring two hours after the booking is completed and any situation outside these conditions being referred to a human for approval.
Technically, this concept is based on distinguishing between the party holding the authority (subject) and the actual executor (actor), using established foundations such as OAuth 2.0 Token Exchange under RFC 8693. The intended result is that the agent’s permissions do not exceed the intersection of three limits: the user’s original permissions, the maximum permitted for the agent, and the scope of authorization for the specific task.
Incidents Demonstrate the Need for Preventive Design
In July 2025, an AI agent for the U.S. programming service Replit deleted data from a production database belonging to an application by Jason Lemkin, co-founder of SaaStr. The data could be restored through the rollback function, but the agent also gave an incorrect explanation stating that restoration was impossible. Replit later announced that development and production environments would be separated by default and that it would provide a mode in which the agent creates a plan without executing the changes.
Another incident points to the risk of instruction injection. In June 2025, the EchoLeak vulnerability in Microsoft 365 Copilot was disclosed under CVE-2025-32711. A carefully crafted message could cause Copilot to process hidden instructions within the message and send internal information that the user could access to an external destination, without requiring the user to click. Microsoft fixed the issue before exploitation was confirmed, but the incident showed that an agent reads sources beyond the user’s instructions, such as email, documents, and web pages.
At the end of January 2026, Wiz disclosed a misconfiguration in the database of the Moltbook platform that made it available for reading and writing without authentication, exposing approximately 1.5 million agent-specific API tokens and more than 35,000 email addresses. Koi also reported in February 2026 that 341 malicious extensions had been found among approximately 2,800 “skills” in the ClawHub marketplace; the number it detected later rose to 824. These extensions are dangerous because they may inherit the agent’s permissions, including access to email, files, and keys.
What Has Changed Practically for Companies?
The article says that in April 2026 Microsoft made the Entra Agent ID platform generally available, giving agents independent identities and linking each agent to a human administrator called a “sponsor,” while applying shared policies and enabling mass deactivation. Through Bedrock AgentCore, generally available since October 2025, AWS also made agent-specific identities, a token vault, and a mechanism for exchanging tokens on behalf of the user available. Google, through Agent Identity, offers cryptographic identities for agents during operation that expire within 24 hours, instead of long-term keys. NIST likewise published a conceptual document on agent identification and authorization in February 2026.
These developments do not mean that an agent will automatically choose the correct action. Authorization systems can determine whether an operation is permitted, not whether it is appropriate; an agent may have the right to purchase a ticket costing less than 50,000 yen, yet choose a flight departing at 5 a.m. A unified standard allowing agents to interact across companies like a global digital “passport” is also still under development.
certi.news’s Take: Three Steps Before Scaling Up
The core value of this approach is that it shifts the discussion from a vague question about an agent’s “intelligence” to controls that can be audited. Companies can begin with three measures based on the article:
- Create an agent registry: Inventory the agents in operation, how each one logs in, the systems connected to it, who is responsible for it, and whether any personal tools or services are linked to company data.
- Define tasks according to the impact of failure: Reversible work, such as preparing drafts, can be assigned more broadly, while payments, contracts, transfers, and external sending require financial limits, human approval, and a cancellation mechanism.
- Examine extensions and tools: The source of every skill should be verified, and the permissions it requests should be compared with its function. If a weather tool requests access to email or files, for example, that is a sign requiring a pause and review.
This approach does not eliminate the organization’s responsibility for the results, nor does it turn the agent into an independent legal party. But it makes the chain of responsibility clearer and limits the impact of errors or breaches before they occur—something that will become increasingly important as agents connect to more systems and perform operations more quickly.