AI Agents Shatter Digital Trust: Who Authorized What?

The fundamental assumption of digital trust—that a person is always behind every online action—is being challenged by AI agents. These agents are increasingly performing tasks that demand more than just authentication or identity verification; they necessitate understanding who authorized the action, what specific permissions were granted, and for how long.

Existing digital infrastructure, including the UK's Data (Use and Access) Act and Digital Verification Services, has largely focused on confirming identity. However, with AI agents operating within business workflows, a critical gap has emerged. This gap concerns verifying not just identity but also the specific authority delegated to these agents for particular tasks.

To address this, businesses must adopt a principle of minimum necessary authority, granting agents only the permissions essential for their designated tasks. This proactive approach, focusing on confirming authority before an agent acts, is vital. Organizations need to establish clear answers to who is acting, who authorized them, what they can do, under what constraints, and if that authority remains valid.

The UK government has an opportunity to extend its existing Digital Verification Services Trust Framework. This framework must evolve to recognize delegated authority not just for human delegates but also for software agents. Machine-verifiable mandates, potentially stored in digital wallets, will be key to ensuring that software agents operate within clearly defined and revocable permissions.