Your AI Agent Can’t Prove Who It Is. Neither Can the One It’s Negotiating With.

Imagine this scenario. Your company’s procurement agent — an AI — negotiates a contract with a supplier’s sales agent — also an AI. The agents agree on terms. A payment is authorized. Goods are shipped.

Then something goes wrong. The wrong product arrives. The price doesn’t match. There’s a dispute about what was agreed.

Your legal team needs to answer a simple question: was the agent on the other side actually authorized to make that deal? And was its identity verified?

The uncomfortable truth, backed by new research published three days ago: no existing identity standard can answer that question.

Not decentralized identifiers. Not verifiable credentials. Not OAuth 2.0. Not FIDO2. Not attribute-based access control. Every single standard was designed for humans and traditional services. None handles what AI agents actually do — act autonomously, delegate recursively to other agents, and execute multi-step transactions across organizational boundaries.

Yao, Brown, Zhang, Pappachan, Long, and Wu have published the first comprehensive analysis of AI agent identity from a standards perspective. Their findings should concern every executive whose organization deploys or plans to deploy AI agents that execute transactions, access sensitive systems, or interact with partner organizations.

The paper identifies five critical gaps, validated through real attack scenarios on production agent platforms. These are not theoretical risks. They are exploitable vulnerabilities in the infrastructure that organizations are currently building their AI agent strategies on.

Executive Summary

Your identity infrastructure works for employees and services. It fails for AI agents. Before deploying agents that execute transactions or cross organizational boundaries, fix identity first.

• G1 — Semantic Intent Verification: No standard can verify what an agent meant to do versus what it actually did. Accidental and intended actions look identical.
• G2 — Recursive Delegation Accountability: Agent A delegates to B who delegates to C. When something goes wrong, who’s responsible? No standard traces accountability through chains.
• G3 — Agent Identity Integrity: Identity spoofing and impersonation are trivial. Can you trust that an agent is who it claims to be?
• G4 — Governance Opacity: Agent reasoning is a black box. Audit trails cannot capture why decisions were made.
• G5 — Operational Sustainability: Can identity verification scale to millions of autonomous agents? Current answer: no.

The proposed framework organizes AI identity into three layers: Intent (what the agent aims to do), Action (what the agent actually does), and Governance (how it is overseen).

Paper at a Glance

The Identity Infrastructure Gap

The identity infrastructure your organization uses today was built for a world where humans and traditional services are the actors. Employees log in with single sign-on. Services authenticate via API keys. OAuth handles delegated authorization. FIDO2 manages device credentials. These systems work because they assume human oversight — a person is present to approve, a session has a clear start and end, and delegation is explicit and bounded.

AI agents break every assumption.

An AI agent does not have a session — it operates continuously, across multiple tasks and contexts. It does not have a single identity — it may act on behalf of different users, departments, or organizations at different times. It delegates recursively — Agent A authorizes Agent B to authorize Agent C, and the chain of accountability becomes untraceable.

And crucially, an AI agent’s intent matters in a way that does not apply to traditional services. If a payment API sends a transaction, the intent is to send that transaction — the code does what it says. But an AI agent might take an action with unintended consequences because its reasoning was flawed, its prompt misinterpreted, or its context incomplete. Current identity infrastructure cannot distinguish between intended and accidental actions.

The paper validates these gaps through attack scenarios on production agent platforms. An attacker can impersonate an agent, inject unauthorized delegations, and obscure the audit trail — all within the constraints of current identity infrastructure.

The Five Critical Gaps

What the Research Found

The finding that matters most: No existing standard is sufficient. This is not incremental — adding a new protocol to OAuth or extending DID specifications does not fix them. The gaps are structural.

The attack scenarios are not theoretical. Every gap is validated through concrete attacks on production agent platforms. These are current exposures, not future risks.

The three-layer framework provides a practical starting point. Intent, action, and governance create a clear structure. Organizations can assess current capabilities against each layer and identify where investment is needed.

The 18 research directions are a governance readiness checklist. For organizations planning AI agent deployments, these directions serve as a structured readiness assessment.

Implications by Role

Business Applications by Function

• AI-to-AI contracting: Procurement and sales agents need mutual identity verification before transacting
• Financial delegation chains: Unauthorized payments are untraceable without accountability tracing
• Cross-organizational data access: Partner data requests need mutual authentication current tools cannot provide
• Regulatory compliance and audit: Current infrastructure lacks the audit trail structure for agent actions
• Agent marketplace security: Brokers cannot verify that listed agents are who they claim to be
• Incident response and forensics: AI agent-caused harm requires forensic identity infrastructure that doesn’t exist
• Multi-agent governance: Identity infrastructure must scale with hundreds of agents — current tools cannot

What Business Leaders Should Do Next

1. Run a five-gap assessment against every AI agent deployment — For each agent that executes transactions or delegates, assess exposure across G1-G5
2. Map agent delegation chains — Identify every chain where accountability breaks down. Assume every broken link is a liability exposure
3. Evaluate cross-organizational agent interactions — If any agent interacts with partner systems, assess identity verification requirements
4. Engage standards bodies on AI agent identity — Existing bodies (W3C, IETF, FIDO Alliance) are not addressing this adequately
5. Build the Intent-Action-Governance architecture into AI platform plans
6. Conduct a regulatory readiness assessment — Map the five gaps against EU AI Act and financial regulation requirements
7. Establish an AI identity working group — CISOs, compliance, legal, and AI engineering must collaborate

Conclusion

Building AI agent infrastructure without identity is building on sand. The gaps are structural, not incremental. Fixing them requires new standards, new infrastructure, and coordinated investment across security, compliance, legal, and engineering.