Delegated authority for AI agents: mandates, scope, revocation

What delegation has to establish

A complete delegation answers six questions, and partial answers create the incidents. Who delegated: a verified human or legal entity, which makes enrollment-grade identity verification the root of the chain. To whom: a specific agent instance with its own authenticated identity, not a product name, because "my assistant" is not an accountable party. To do what: an action vocabulary, purchase, schedule, query, transfer, with parameters. Within what limits: amounts, merchants, categories, rates, time windows. Until when: expiry as a property of the grant, not a hope. And provable how: a signed artifact each relying party can verify without calling the issuer. The legal entity identifier world reached the same decomposition independently, its verifiable LEI model answers who sent an agent, what it may do, and for how long, which suggests the six questions are the stable core, whatever syntax wins.

The anatomy of a mandate

A mandate is a signed, tamper-evident data object binding principal, agent, scope, and validity. The emerging two-layer pattern is worth internalizing. An intent mandate captures the standing instruction, buy the usual groceries weekly, under 150 dollars, from these merchants, signed once by the principal and presented by the agent on each use. An execution-level artifact, AP2 calls it a cart mandate, signs the specific final action: this basket, this price, this merchant, this moment. The split exists because the two layers fail differently: a leaked intent mandate exposes a bounded capability, while execution artifacts are single-use and worthless to replay. Between them sits the binding problem, proving the agent presenting the mandate is the agent named in it, which is where agent credentials, attested runtimes, and human-presence checks for sensitive steps earn their complexity.

Scope design: the difference between a key and a keyring

Scoping is where programs get hurt, because the convenient grant is the broad one. Four disciplines keep delegation honest. Enumerate, never default: scopes should name permitted actions, with everything unnamed denied, the posture enterprise security rediscovered when Microsoft began applying zero-trust conditional access to its own internal agents. Bound every dimension: an amount cap without a velocity cap invites a thousand small purchases; a merchant list without a category bound invites gift cards. Separate read from act: an agent that researches and an agent that buys should hold different grants, so a compromised research loop cannot spend. And step down for risk: the mandate itself should declare which actions require fresh human confirmation, making escalation a property of the grant rather than a merchant's guess. Scope reviews belong on the same cadence as access reviews, because agent sprawl inside enterprises is already outpacing the inventories meant to track it.

Revocation and sub-delegation: the unsolved edges

Revocation sounds simple, delete the grant, and is not, because mandates are bearer-presented artifacts verified offline. If a relying party can validate a mandate without phoning home, it also cannot learn the mandate died an hour ago. The design space is the familiar one from certificates: short expiries that make revocation mostly unnecessary, status endpoints the verifier checks for high-value actions, and revocation lists for the long tail, with the right mix set by action risk. Short-lived, narrow mandates re-issued often are the current best practice, trading issuance load for a small blast radius. Sub-delegation is harder still: agents that spawn sub-agents propagate authority in ways the original grant may never have contemplated, so mature designs either prohibit sub-delegation outright, or require the chain to carry every hop's identity so the relying party sees principal, agent, and sub-agent in one verifiable lineage. An unattributed hop anywhere in the chain is the agent-era version of an unlogged shared account.

The audit trail is the product

Regulated adopters should assume the examiner's question is not whether they use agents but whether they can replay any agent action: which human, which mandate, which scope check, which result, on what evidence. That argues for logging mandates as first-class records, retaining verification outcomes alongside transactions, and treating mandate issuance like credential issuance, with ceremony, identity proofing, and a decision plane that evaluates every presented mandate against live risk rather than rubber-stamping valid signatures. FinCEN's acceptance of verifiable credentials for customer verification in certain circumstances cuts both ways: signed artifacts can satisfy obligations, and signed artifacts from weak enrollments will be treated as the institution's failure, not the protocol's. Delegation done well is not a loosening of control, it is control made legible: every grant bounded, every action attributed, every chain replayable. That is a higher standard than most human proxy arrangements ever met, which is the quiet opportunity in the agent era, not just new risk, but the first chance to make authority itself auditable by default.

A rollout sequence that survives review

Organizations adopting agent delegation can sequence the work so each stage produces evidence the next one needs. Start with inventory and prohibition: catalog every agent already acting on company or customer authority, shadow deployments included, and formally prohibit sub-delegation and unscoped grants while the program stands up. Second, fix the root: require enrollment-grade identity verification for every principal who will issue mandates, since every later signature inherits this step's quality. Third, issue narrow and short: first production mandates should cover one action class with tight bounds and expiries measured in days, so revocation is nearly moot and incidents stay small. Fourth, wire the ceremony: define which actions demand fresh human presence, implement the step-up flow, and test that a compromised agent genuinely cannot cross it. Fifth, turn on the replay: before scale, prove to an internal audience that any sampled agent action can be reconstructed end to end, principal, mandate, validation, outcome, in minutes rather than days. Only then widen scopes, admit more action classes, and consider chained delegation. The sequence is deliberately conservative because the failure mode of agent programs is not the dramatic rogue purchase, it is the quiet accumulation of broad, stale grants nobody can map to a human anymore, discovered during the first serious dispute.