The Four Pillars of Identity for AI
The core principles of governing agentic actions: Delegation, Least Privilege, Human Oversight, and Auditability.
From Access Control to Action Accountability
Unlike traditional identity where a person logs in and performs a task, AI agents blur the lines between actor, approver, and executor. To manage AI agents responsibly and transparently, your identity architecture must answer four core questions: Who is acting? Who authorized the action? On whose behalf? With what permissions?
The Four Pillars of Identity for AI
- Delegate, Don't Impersonate: AI agents should never log in with a human user's credentials or "borrow" their access. Instead, use authenticated delegation. Issue scoped, temporary tokens that clearly define what an agent is authorized to do.
- Enforce Least Privilege: Agents often operate at machine speed and scale. Assign agents only the access they need for their specific function, and no more. Implement just-in-time entitlements and ephemeral tokens to limit blast radius.
- Maintain Human Oversight: For high-risk, high-value, or irreversible actions, integrate human-in-the-loop (HITL) approval flows. Allow users to validate sensitive agent actions in real time.
- Make Every Action Auditable: Every agentic action must be attributable, explainable, and reviewable. This means logging not just the action, but the actor (agent), the delegator (if any), and the policy or scope under which the action occurred.