Modern organizations depend on identity. Before someone can access information, authorize expenditure, modify a system, or represent an institution, we ordinarily need to know who they are and on whose authority they are acting. Agentic AI complicates this basic assumption.
An AI agent may act directly for a person, on behalf of a department, under authority delegated by another agent, or as part of a workflow involving several autonomous systems. When an action occurs, it may therefore be unclear whose authority the action represents. Was the agent acting for a particular employee, for the organization, for another system, or under authority it inferred from an objective?
This makes AI identity a foundational governance problem. Autonomous systems need identities that can be authenticated, permissions that are specific to those identities, and mechanisms for recording which human or organizational principal delegated authority to them. The ability to act should be tied to the identity under which the action is performed.
Machine identity also matters for accountability. If multiple agents communicate and delegate tasks to one another, organizations need to preserve the chain through which authority travelled. Knowing that “the AI did it” will not be sufficient. We will need to know which agent acted, for whom, using whose authority, and within which mandate.