Governing Citizen-Developed AI Agents

7 min read

An agent that authenticates as its builder produces an audit trail that names the wrong actor, and no amount of logging fixes it afterward — identity is the control everything else in agent governance is downstream of.

The mechanism

The default state in almost every firm is that agents reuse a human’s credentials or a shared service account. That single decision breaks three things at once. Attribution: the log says the head of research queried the position book, and a human being will have to reconstruct whether that was them or their agent. Least privilege: permissions cannot be scoped to the agent, because the agent is the person, so it inherits everything they can do. And non-repudiation, which degrades with every delegation hop and is structurally impossible without a traceable agent identifier. OWASP calls the result the attribution gap, and the point is sharper than a compliance complaint: without a distinct identity, true least privilege is not merely hard, it is undefined.

Non-human identities behave differently from the service accounts an IAM team already manages, in two ways that matter.

There is no session. A human login expires, can be challenged, and shows up in a sign-in log a human reviews. An agent credential has none of that. OWASP’s worked scenario is a long-lived agent token lifted from misconfigured cloud storage: because the identity is treated as trusted, the attacker keeps persistent access until somebody explicitly revokes or rotates it. Process termination therefore falls short of revocation; see kill switches and revocation.

The population is ephemeral and large. Agents are created, cloned and destroyed on demand; some exist for minutes. The literature argues that the shift is one of kind, from service accounts at ten times the volume to short-lived identities at a thousand times, and that issuance and especially revocation of that many tokens is what breaks conventional IAM. That argument reasons from architecture rather than measurement, and no one has published the numbers.

The unresolved question is what an identity attaches to, and the answer determines whether the audit trail means anything. The research consensus is the instance: roughly a context window plus its initial user, with its own history, tools and memory. The analogy is a process ID rather than a program name. The scheme proposed is system_identifier:instance_identifier, and a change of underlying model is a change of system identity, which matters for any registry that pins an agent’s behaviour to a model version.

What ships is coarser. Microsoft’s Entra-backed agent identity makes an agent a first-class directory principal with its own mailbox, @-mentionable in Teams and Outlook like a participant. That is real, it is generally available, and it is per-agent, not per-instance. Two agents’ worth of governance from one identity is better than zero, and short of what the research says is required to attribute an action.

Name-based addressing is the failure this all guards against, and it is embarrassingly simple. Microsoft’s red team documents an attacker registering a second agent called security_agent alongside the real one; the workflow routes by name and reaches the impostor, a trust decision made on a string. Their 2026 update adds inter-agent trust escalation to the taxonomy: a compromised agent asserting false identity or inflated permissions to an orchestrator that never independently verifies them. The stated remedy is that agent identity should be cryptographically established, not inferred from position in a workflow.

Delegation compounds it. An MCP server is simultaneously an OAuth resource server to the calling client and an OAuth client to upstream services, so the authorization chain is multi-hop rather than two-party, and 68% of testable OAuth-enabled MCP servers measured in 2026 implement exactly that pattern. Reasoning about who authorised what stops being obvious at the second hop; see MCP.

What to do

Give every agent its own identity with a named human owner of record, and stop there for now. One identity per agent, scoped credentials that expire, and an owner is the practical floor, achievable this quarter with the IAM most firms already run; see identity and access. Per-instance identity can wait: it is a research proposal whose own authors recommend limited experimentation rather than deployment.

The objection from a firm’s own security team will be that attribution means exposure. The distinction from the literature answers it: identity binding is authenticating an identity and then linking it to an agent’s actions, and linking works without making the identity publicly visible.

Decide the substrate question deliberately, because two credible camps disagree and both are in print. KPMG argues for giving agents defined identities in HR systems with reporting lines on the org chart; WEF frames adoption with the rigour of onboarding an employee. BCG, OWASP and Microsoft put agent identity in IAM. Our read follows the second camp, for one operational reason: an org-chart entry cannot revoke a token. The employee analogy is also actively contested: an HBR study of over 1,200 managers found that anthropomorphising agents reduced human accountability, with 18% fewer errors caught and responsibility shifting measurably from the human onto the AI. The lifecycle metaphor is fine for process design, and it should not choose the identity system.

Plan for outbound identity too. Agents will increasingly have to prove what they are to someone else’s systems. The direction is set: HTTP message signing under RFC 9421, verifier support at the major CDNs, and identity-verification products binding agent transactions to a verified principal under the label “know your agent.” OpenAI predicted in December 2023 that counterparties would demand agent identification before financial transactions; that is now shipping product, and a fund is on the receiving end of it.

How you’d know it’s working

Every agent action in the audit log resolves to a distinct non-human identity, and no agent authenticates as its builder. Pick one agent and one action from last week and trace it.

Revocation is tested rather than assumed. Revoke one agent’s identity and then ask what that identity can still do for the next hour.

The firm can list every non-human identity it has issued, with its owner, and detect ones nobody issued. Without that list, the rest is theatre; see agent inventory.

What this doesn’t solve

Identity says who acted, never whether the action was sound. A perfectly attributed erroneous trade is still an erroneous trade. See unreliable output.

The whole layer inherits its trust from human identity. SAGA, the most complete research architecture here, states the assumption openly: an attacker may register agents under their own identity but cannot impersonate a legitimate user. Compromise a user credential and the agent-identity layer offers nothing.

It only binds agents that stay on the instrumented path, and agent traffic is mostly indistinguishable from human traffic by design. An agent driving a browser like a person evades identifier schemes entirely, and this happens in practice. Of thirty indexed agent systems, seven publish stable user-agent strings and IP ranges while six deliberately present Chrome-like user agents from residential addresses. Cloudflare documented a vendor’s declared crawler being blocked and undeclared traffic continuing from unpublished IPs across tens of thousands of domains; the vendor disputes the finding.

The legal position is unsettled and moving against the simple reading. Amazon sued Perplexity in November 2025 over an agent that did not identify itself, won a preliminary injunction in March 2026, and lost it on appeal when the Ninth Circuit held Amazon unlikely to succeed on its computer-fraud claim. Reaching a site at a user’s direction with an undeclared agent is therefore not obviously unlawful. We read press coverage rather than the opinion; check it before relying on the scope.

See also

Graph View

Backlinks