Agent Identity and Delegated Authority as Detection Data

The phrase the AI did it hides the security model

An assistant reads a support request and issues a refund. A model generated output, but an application interpreted it, an agent runtime selected a tool, a credential authorized the request, and a business service changed the customer account.

An agent is software that uses model output to select or sequence actions toward a goal. The model does not gain authority by producing text. Authority comes from the surrounding identities, credentials, policies, tools, and services.

Separate the human or system that initiated the task, user session, application, agent instance, model and policy version, tool server, executing principal, and target resource. This prevents the immediate API caller from replacing the subject whose goal or data influenced the action.

Delegation is a relationship with scope and lifetime

A user can authorize an application. The application can invoke an agent. The agent can call a tool using a service account or delegated token. The tool can act on a resource. Each handoff should state who delegated what authority to whom, for which purpose, target, and time.

Record grant or credential type, scopes or roles, tenant, subject, audience, issuance, expiration, confirmation, policy decision, and revocation state. A broad service credential may allow actions the initiating user could never perform. A user token may preserve subject identity while still granting more scope than the task needs.

Do not infer authority from successful execution alone. A target service can accept an overbroad credential. Detection asks whether the accepted authority fits the intended delegation chain.

Influence and authority meet at the tool boundary

A retrieved document has no legitimate authority, yet its text can influence model output. If that output causes a privileged tool call, untrusted content has steered authority across a boundary. This is related to the confused-deputy problem: a component with legitimate power is induced to use it for a party that does not possess it.

Preserve which inputs were treated as instructions, which retrieval sources contributed context, which memory state was active, which policy allowed the tool, and whether a human confirmed the action. Avoid claiming the model’s generated rationale reveals true causality; it is another output.

The important relationship is observable: this untrusted source entered the decision context before this authority was exercised against this target. Intent remains an assessment.

Correlate without collapsing asynchronous work

Agent systems create planners, subagents, retries, queues, background jobs, and callbacks. One trace identifier can help, but it may be reused or lost across services. A child action can continue after the initiating session ends.

Record parent and child execution identifiers, causation or request links, timestamps, queue or job IDs, user and application context, and target operation. Distinguish a trace relationship from proof that one output caused another action.

The AI tool-call telemetry should let an investigator reconstruct the action graph while preserving missing links and uncertainty. A single shared service account cannot be the only entity key.

Make the identity chain visible in the result

An investigation-ready result states who initiated the task, which application and agent instance acted, which model and policy versions were involved, which credential and scopes authorized the tool, what target changed, and what the service returned. It identifies untrusted inputs and required confirmations.

Then separate assessment: the action exceeded the task, violated a policy boundary, or used authority inconsistent with the initiating subject. State uncertainty about model influence, user intent, and incomplete asynchronous traces.

This model makes agentic systems less mysterious. They become distributed authorization and decision systems whose identities and handoffs can be examined like other security-relevant workflows—provided telemetry refuses to compress them into “AI user.”