Trusted AI Agent Transactions, Part 1: The Identity Problem
The identity problem behind AI agents An application that calls an API for a user normally answers one identity question: who is the user? An AI agent introduces several more: Which user authorized the work? Which logical agent is acting? Which running workload actually made the call? Which agent execution is involved? Which transaction and purpose does the call belong to? Which service made the…
The article discusses the identity problem associated with AI agents and their transactions. It highlights that an AI agent introduces additional questions related to identity, such as which user authorized the work, which logical agent is acting, which running workload made the call, and which transaction and purpose the call belongs to.
The article argues that a logical agent name is not enough to prove the running process and that a workload identity is not equivalent to the user. It also states that a transaction identifier is not a caller identity. To address these issues, the article proposes a Transaction Tokens architecture, which separates UserID, AgentID, AgentInstanceID, SPIFFEID, and TransactionID into distinct values.
The article explains that passing the original user token through every service has three problems, including the inability of downstream services to distinguish the user from the agent acting for the user, the risk of broadly scoped user tokens reaching unnecessary systems, and the lack of purpose-specific information in the token.
The safer model is the Transaction Tokens architecture, which uses a short-lived signed Txn-Token containing immutable identity and authorization context for one call chain.
Brief written by urgent.news from Dev.to's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
