AI Agents Put Digital Authority Checks Under Scrutiny

AI agents are taking on transactions and administrative tasks that once required people, raising questions about how businesses verify what those agents are allowed to do. Existing login systems can check credentials and identity, but they may not establish who authorized an agent’s action, its limits or how long that permission remains valid.

In the UK, the Data (Use and Access) Act established a statutory footing for Digital Verification Services (DVS). The DVS Trust Framework also recognizes delegated authority when a person acts for another person or an organization. But the framework does not yet address how that principle should apply when software acts as the delegate.

The article argues that businesses should give agents specific, limited mandates rather than copies of people’s access. It says organizations should record who granted each mandate and when it can be withdrawn. For an agent’s action, businesses should be able to establish who or what is acting, who authorized it, what it can do, what constraints apply and whether its authority is still valid.

These checks could draw on “on-behalf-of” (OBO) delegation models used in identity standards. Digital wallets are one possible place to hold a machine-verifiable mandate alongside verified credentials, the article says, though they are not the only option. It argues that the UK should extend its existing delegated-authority approach to software agents as deployments grow.

The article is by Jonathan Evans and was published in TechRadar Pro Perspectives.