AI agents are becoming an identity-and-authority control

Observed facts: standards work is moving below the model layer

The United States National Institute of Standards and Technology launched an AI Agent Standards Initiative in February 2026 to support interoperable and secure agent systems. Its stated work includes identifying standards and protocols for agent interactions, advancing research on agent identity and authorization, and developing guidance for secure deployment [1]. That agenda is notable because it treats an agent as more than a conversational model. Once software can select tools, exchange messages with other agents or act across business systems, its identity and authority become part of the control surface.

NIST's May analysis of responses to its agent-security request for information described recurring issues around security threats, mitigation, assessment, implementation guidance, information-sharing and standards [2]. The responses do not create a finished standard, and they do not prove that one architecture will fit every organisation. They do show that independent contributors are converging on a practical problem: an agent's useful autonomy depends on reliable answers to who or what initiated the action, what authority was delegated, which resource was accessed and how the result can be reviewed.

Observed facts: adoption is ahead of governance in many businesses

The UK Business Data Survey 2026 found that 41% of businesses handling digitised data used AI for at least one purpose, rising to 82% among large businesses. Governance was less consistent: 17% of AI-using businesses reported having no AI policy, while 56% of large businesses reported a formal written policy [3]. These figures describe surveyed UK businesses rather than the global market, and policy presence is not the same as effective technical control. Even so, the gap between use and governance suggests that many organisations are adding AI capabilities before they have a complete operating model for them.

The same survey reported that AI-using businesses tended to have more developed data practices, including higher reported rates of data collection, analysis and sharing than non-users [3]. That relationship matters for agentic systems because the benefit often comes from crossing system boundaries: reading a document store, updating a customer record, preparing a payment file or triggering a workflow. Each additional connection expands both utility and consequence. A generic policy can describe acceptable use, but it cannot by itself prove that an individual agent had the correct permission for a specific action.

Observed facts: transparency duties now reach system outputs

The European Commission's current AI Act implementation guidance says transparency rules applying from 2 August 2026 require people to be informed when they are interacting with an AI system in specified circumstances, and require certain AI-generated or manipulated content to be identifiable or labelled [4]. The Commission also distinguishes those transparency duties from the separate timetable for high-risk-system obligations. The exact legal position depends on the system, role, content and use case, but the direction is operational: organisations need to know which system produced an output and when disclosure or labelling is required.

For an AI agent, output provenance can be harder than a single chatbot notice. An agent may retrieve material, call a third-party service, transform the result and write into another system. If the record only shows a shared service account or a final text string, it may not preserve the chain needed to explain the action. Transparency therefore connects back to identity: the organisation needs a durable link among the human or process that initiated work, the agent instance, the model and tools used, the permissions exercised and the final business record [1][4].

Oakhampton inference: create an agent authority record before production access

Oakhampton's inference is that production agents should receive an authority record before they receive broad system access. The record should identify the business owner, approved purpose, triggering conditions, permitted tools, data classes, write limits, escalation conditions, credential or service identity, logging location and expiry or review date. This is an operating recommendation derived from the standards, survey and regulatory evidence; none of the sources prescribes one universal record format [1][2][3][4]. The objective is to make delegated authority explicit enough that access can be tested and withdrawn without reconstructing intent from code or chat history.

The strongest design separates recommendation from execution. Lower-risk agents can gather evidence or prepare a reversible draft. Higher-consequence actions can require a second control, such as a transaction limit, an independently authenticated approver or a deterministic policy check. Logs should preserve attempted as well as completed actions, because a denied request can reveal scope drift or prompt manipulation. Shared credentials should be avoided where they erase attribution, while short-lived or narrowly scoped permissions reduce the impact of an agent behaving outside its intended task.

• Assign each production agent a named owner, purpose, service identity and review date.
• Express tool and data permissions as allowlists with explicit write and value limits.
• Keep an action trail linking initiator, agent, tool call, policy decision and resulting record.
• Require a separate approval control for money, legal commitments, deletion or other material external action.

Remaining uncertainty should stay visible in deployment decisions

The evidence does not establish that today's identity standards are complete or interoperable across every agent framework. NIST's initiative remains standards-development work, survey percentages cannot measure control quality inside individual firms, and EU obligations require case-specific legal analysis [1][2][3][4]. Agent capabilities and provider architectures are also changing faster than many enterprise access-review cycles. A control designed around one vendor's session model may not survive a move to multi-agent orchestration or a different tool gateway.

The bounded conclusion is that organisations can test authority hygiene now without waiting for a final universal standard. They can inventory production agents, eliminate anonymous shared access, document permitted actions, impose consequence-based approvals and verify that logs reconstruct an action from request to result. They cannot infer safety from a model benchmark, a vendor assurance or the existence of a policy document alone. Where identity, delegation or audit evidence remains unresolved, the safer state is constrained assistance rather than unattended execution.