Systems Design Meditation · Edition 3
Identity for Machines
Authorization in the Agentic Internet
Edward Calderón
Software Architect
For years, digital identity asked: Who are you?
Agentic systems introduce another question: What are you allowed to do on my behalf?
Authentication establishes an actor. It does not explain the delegation that made an action legitimate. That difference becomes critical when software can plan and execute across several services.
A graph of authority
The emerging relationship is not one login but a graph:
human ↔ agent ↔ service ↔ infrastructure
Each edge needs its own claim. A human may authorize an agent to reconcile invoices, but not to create suppliers. The agent may call an accounting service, which relies on cloud infrastructure. Passing one durable credential through the entire chain collapses distinct trust boundaries into one secret.
A robust system must know who created the agent, who authorized it, what authority was delegated, which resources it can access, how long the authority exists, which actions occurred, whether they can be verified and whether access can be revoked immediately.
Credentials alone cannot express that history. A valid token may prove that a workload can call an endpoint. It does not necessarily prove that this user approved this purpose under this policy at this time.
Identity is becoming dynamic
Human identity is often relatively durable. Agent authority should usually be ephemeral and contextual. It can be derived for a task, narrowed for a tool and expire when the workflow ends. The boundary may tighten as risk increases.
This is compatible with zero trust: do not treat network location or a previous login as permanent evidence. Evaluate the actor, requested action, resource and current context. Short-lived credentials reduce exposure, but the authorization decision remains explicit.
An autonomous actor should not simply possess credentials. It should operate inside a verifiable boundary of authority.
Suppose an executive delegates travel planning. The agent may read calendar availability and compare flights. Booking a refundable ticket under a limit could be allowed. Booking non-refundable travel, changing a passport record or inviting an external attendee might require fresh approval. “Access to travel” is too coarse; authority is a set of constrained transitions.
Provenance makes the chain inspectable. An audit record should link the human delegation, agent instance, policy version, service identity and resulting operation. Cryptographic signatures can protect evidence, but signatures do not decide whether the policy was sensible. Governance still defines acceptable delegation.
Revocation is part of identity
Systems frequently treat revocation as administrative cleanup. For agents it is part of runtime control. Authority may need to disappear because a device was lost, a workflow was cancelled, behavior crossed a threshold or the delegating human changed roles.
Immediate revocation is difficult in distributed infrastructure. Cached policy, offline credentials and long-running jobs can continue. Designers must choose the maximum acceptable delay and build enforcement points accordingly. This is a systems property, not a checkbox in an identity provider.
Machine identity also needs separation from agent identity. A workload can be genuine software running in an attested environment while the agent session operating within it has a narrower, delegated purpose. Conflating them gives every reasoning process the workload's full authority.
Digital identity work has long dealt with issuers, holders, verifiers and trust frameworks. Agentic systems add moving actors and rapid delegation, but the underlying lesson remains: trust is contextual. Verification only matters relative to a decision.
The next identity problem is not only proving who an actor is.
It is proving what that actor was authorized to do.