AI agent identity
Non-human identity · Agent ID
AI agent identity is the means of recognizing which agent is acting, on whose behalf, in which version and under which mandate. It makes each action attributable to an agent and then to a responsible person, and it says nothing on its own about what the agent has the right to decide.
What a useful identity contains
- A unique identifier per agent, never shared between agents and never borrowed from an employee's account.
- The organization and the named owner behind it.
- The purpose and the mandate in force.
- The model and version it runs on, because a change of version makes it in part a different agent.
- Its status: active, suspended, withdrawn.
Identity is a precondition and not a guarantee
Identity tells you who acted. It does not tell you whether the action was acceptable: a perfectly identified agent can still make an unacceptable decision within rights it legitimately holds. Separating authorization from authority is therefore the next step.
The OECD reports that practitioners find classic identity and access management tools poorly suited to agents. Those tools were designed for people who log in, follow a stable role and work at human speed, whereas an agent may be created for an hour, act at scale and receive instructions from documents it reads along the way.
Identity toward the outside world
When an agent deals with people, Article 50 of the AI Act requires them to be told they are interacting with an AI. When it deals with third parties, such as a merchant or another company's agent, those parties increasingly want to check who is behind it, which is the subject of Know Your Agent.
Frequently asked questions
Should an agent use an employee's credentials?
No. Its actions could not be told apart from those of the employee, its rights would exceed its task, and any audit trail would point to the wrong person. Each agent gets its own identity with limited rights.
What is a non-human identity?
An account used by software and not by a person, such as a service account, an API key or an agent. Agents are a recent and particularly autonomous type of non-human identity.
Where does your organization stand?
ACF Score measures your agentic governance in about 10 minutes, the AI Act checker tells you which obligations apply, and ACF Control applies your rules before an agent acts.
Related terms
Primary sources
Written by Vincent Dorange, creator of the Agentic Commerce Framework®. Last updated .