Let’s discuss agent identity.

[chgaowei]

Agent identity is a key module of the protocol—what is the primary issue it aims to address at the outset?

I’d like to know how others view this question.

[chgaowei]

At the second community meeting, Victor discussed several issues related to agent identity, authorization, and trust. I would like to continue exploring this topic in more depth here.

[victorjunlu]

I believe this work group need to focus on enabling AI agents to be "authenticated, authorized, and trusted" by defining interoperable protocols and governance models for identity, delegation, and accountability across dynamic, multi-party systems.

[chgaowei]

During the discussion, I realized that we may need to prioritize refining the use cases.

Because I found that our understanding of the future AI agent interaction process is not consistent. It might be better if we discuss starting from a concrete use case.

[teamktown]

Here are a few of the identity related topics. Note that I'm adding them here however if they merit being their own issue for tracking, that can be done as well. A possible use case is provided as well as some observations about the challenges:

Example Problem Statement

Consider a realistic scenario: A single user has 20 AI agents working simultaneously - 5 for email management, 10 for research tasks, and 5 for calendar coordination. The current specification doesn't adequately address:

1. Identity Collision: How do we distinguish between Agent A and Agent B both claiming to act on behalf of User X?
2. Audit Trail Complexity: When 20 agents perform actions under the same principal, how do we maintain clear accountability?
3. Permission Scope Conflicts: If agents have overlapping but not identical scopes, how are conflicts resolved?
4. Lifecycle Management: How are workload identities created, updated, and revoked across multiple agents?

Specific Issues to Address

1. Workload Identity Multiplicity in Swarm Scenarios
Current Gap: The specification doesn't distinguish between multiple agents operating under the same principal.
Concerns:

• Identity collision when multiple agents claim the same workload identity
• Unclear audit trails when actions can't be traced to specific agents
• Permission scope conflicts between agents with overlapping capabilities
• No mechanism to handle agent-specific constraints within shared workload identity

2. Workload Identity Lifecycle Management
Current Gap: No defined lifecycle for workload identity creation, management, and revocation.

Concerns:

• How workload identities are initially provisioned to agents
• What happens to in-flight operations when a workload identity is revoked
• How agents handle identity refresh/renewal in coordinated manner
• Coordination between agents when shared workload identity permissions change

There are more in the multiplicity scenario, but certainly the security mechanisms in play for throttling, zero trust models, and policy enforcement are not ready for the case where duplicate but 'authentic' identities are at the gateways where there may be policies to detect multiple connections as an 'identity related threat when 20 of the same person appear' when it becomes normal business. These security countermeasures are likely to prevent DDOS scenarios that AI can execute as a normal approach at parallelizing the pursuit of a task/outcome.

These are not on the distant horizon but are present now and current systems are not able to adequately scale or handle things in the current practices and are these kind of things in scope with this work?