Patterns

In short: these explainers cover the building blocks behind the key's results. Each describes one pattern for AI agent identity, how it works, what vendors document for it and where to begin. Read them when a result names a pattern you have not used before.

On-behalf-of delegation

on-behalf-of delegation lets an agent act with a person's authority while keeping its own identity. Every request should carry both the agent and the person, and the agent should never exceed what that person may do. Logs then show who asked and which agent acted.

Autonomous service agents

autonomous agents run without a person, for a system, schedule or pipeline. They need their own identity, an accountable owner and access that is short-lived and scoped to each task. The usual order is discovery, then removing stored secrets, then per-action policy with evidence.

Agent-to-agent chains

when agents call other agents, each hop lengthens the delegation chain. The receiving agent must know who called it and on whose behalf, and permissions must narrow at every step. Gateways and token exchange keep the original person and purpose attached all the way down.

Human approval and CIBA

human approval pauses a risky agent action until a named person confirms it on a separate device. CIBA is the OpenID standard for asking a user to approve asynchronously. For staff, a governance layer usually provides the approval step, with policy deciding which actions need a person.

Short-lived tokens and token exchange

short-lived tokens expire in minutes or hours, so a stolen copy is soon useless. Token exchange trades one token for a narrower one aimed at a specific tool. Together they let agents work without standing credentials, which is the first goal of most agent identity programmes.

Workload identity with SPIFFE

SPIFFE gives each workload a cryptographic identity from its environment, delivered as a short-lived SVID. Agents running as services can prove who they are without a stored secret, then exchange that proof for access. It is a standards-based fit for Kubernetes and cloud estates.

Gateway enforcement for MCP

an MCP gateway sits between agents and MCP servers so every tool call passes through one place. It identifies the agent and the person behind it, checks policy, hides tools the agent may not use and supplies credentials. It works across identity providers and third-party servers.

IdP federation with Cross App Access

Cross App Access lets the company identity provider broker an agent's access to apps for a signed-in user. The agent receives an ID-JAG instead of collecting a token per app. Admins see and revoke access centrally. It became the MCP Enterprise-Managed Authorization extension.