Identity Names the Agent. Authority Controls the Action. Evidence Proves What Happened.

AI Agent Governance / Runtime Authorization / Sovereign Infrastructure

Identity Names the Agent. Authority Controls the Action. Evidence Proves What Happened.

  Estonia’s AI-agent ID proposal, the rise of U.S. agentic security startups, and the legal gap around AI-agent evidence all point to the same missing layer: runtime intent-aware authorization.

  By Adam Straughn ·
  June 24, 2026

Summary

  The next moat in AI agent governance is not the model. It is not a prompt template. It is not a markdown policy file that hopes the agent behaves.

  The moat is the external policy enforcement layer that cryptographically binds a verified human principal to a specific agent action, limits that action with ephemeral authority, and produces a tamper-evident forensic record afterward.

  In simpler terms: identity answers **who** the agent is. Authorization answers **what** the agent may do. Evidence proves **what actually happened**.

Contents

  - [Identity Is Necessary, But Not Sufficient](#identity-gap)
  - [Runtime Intent-Aware Authorization](#runtime-authorization)
  - [Blended Identity and Ephemeral Tokens](#blended-identity)
  - [The Zero-Bypass Gateway](#zero-bypass)
  - [Tamper-Evident Forensic Trails](#forensic-trail)
  - [Estonia and Sovereign Agent Identity](#sovereign-layer)
  - [The Market Gap](#market-gap)
  - [Conclusion](#conclusion)

1. Identity Is Necessary, But Not Sufficient

  Estonia’s June 2026 proposal to create digital identities for AI agents marks a major shift: agent identity is becoming state infrastructure.
  [[1]](#ref-1)
  This matters because autonomous software systems are beginning to act on behalf of humans, companies, and public institutions.

  But identity alone does not solve the real governance problem.

  A digital ID can tell a system which agent is acting. It does not automatically answer who delegated authority to that agent, what the agent was allowed to do, whether the action was permitted at runtime, or what evidence proves the action stayed inside its boundaries.

  This is the identity-authority gap. It is the difference between naming an actor and controlling an action.

    Identity names the agent. Authority limits the agent. Evidence makes the agent accountable.

2. The Real Moat: Runtime Intent-Aware Authorization

  Traditional Identity and Access Management was built around humans and predictable machine-to-machine integrations. AI agents break that assumption. They interpret natural language, select tools dynamically, generate parameters at runtime, and may delegate subtasks to other agents.

  That means the control point cannot live inside the model. The control point must sit outside the model as a Policy Enforcement Point, or PEP.

  The PEP evaluates each tool call before execution. It checks the agent identity, the human or organizational principal, the delegated task, the requested resource, the environmental context, and the risk of the action. This is where Runtime Intent-Aware Authorization becomes the strategic layer.
  [[2]](#ref-2)

  Prompt guardrails ask whether something is safe to say. Runtime authorization asks whether something is safe to do.

    Guardrails vs. Runtime Authorization

        Layer
        Primary Question
        Failure Mode If Missing

        Conversational guardrails
        Is this prompt or output safe?
        Jailbreaks, toxic output, PII leakage, hallucinated responses.

        Runtime authorization
        Is this action allowed right now?
        Tool abuse, credential exfiltration, unauthorized transactions, privilege escalation.

3. Blended Identity and Ephemeral Tokens

  The first architectural primitive is blended identity. In current agent deployments, identity often gets erased. An agent borrows a human user’s credentials, uses a broad service account, or executes through a generic API key. Downstream systems may see that an action occurred, but not which human authorized it or which agent instance performed it.

  Blended identity fixes that by cryptographically binding the agent identity to the verified human or organizational principal. One practical pattern uses OAuth 2.0 Token Exchange and JWT actor/subject claims to preserve lineage between the human principal and the agent actor.
  [[3]](#ref-3)

  The second primitive is ephemeral tokenization. Instead of long-lived service credentials, the system issues short-lived, task-scoped credentials at runtime. These credentials should be bound to the specific agent instance, limited to the minimum required action, and expire automatically after task completion.

  This matters because static credentials create a large exploitation window. If a token remains valid after the task is complete, a stolen credential can continue to authorize actions the agent no longer needs to perform. Cloud Security Alliance research has emphasized this exact problem in agent identity design: durable identity without task-scoped authorization creates unnecessary exposure.
  [[4]](#ref-4)

    Static Credentials vs. Ephemeral Agent Credentials

        Credential Model
        Typical Behavior
        Risk
        Better Pattern

        Static service account
        Long-lived credential with broad access.
        Credential theft, lateral movement, privilege drift.
        Replace with runtime-issued, task-scoped token.

        Borrowed human credential
        Agent acts as if it were the user.
        Non-repudiation failure and unclear liability.
        Bind human principal and agent instance separately.

        Ephemeral agent token
        Short-lived, scoped, task-specific authorization.
        Lower replay window and lower blast radius.
        Issue through an external credential broker.

4. The Zero-Bypass Gateway

  The Model Context Protocol, or MCP, is rapidly becoming a common interface between models, tools, APIs, and data sources. That makes the MCP boundary strategically important. If an agent can reach a tool, database, browser, filesystem, or payment endpoint through MCP, then the MCP gateway becomes a natural enforcement point.

  A Zero-Bypass MCP Gateway is a state-aware proxy that intercepts tool registration and inspects model-generated parameters before they reach target infrastructure. It does not merely filter language. It validates action.

  This design prevents the confused deputy problem: a trusted agent being tricked into using its authority for an attacker’s purpose.

  Several U.S. agentic security startups are already converging on this layer. Aurascape has been described around Zero-Bypass MCP Gateway patterns, Aembit around MCP identity and secretless workload access, and Keycard around task-scoped cryptographic delegation.
  [[5]](#ref-5)
  [[6]](#ref-6)
  [[7]](#ref-7)

  The gateway should not trust the model’s intent claim by default. It should require structured intent, scoped authority, and runtime verification.

  - **SPIFFE/SPIRE** for workload identity and platform-attested service identities.
  - **OAuth token exchange** for preserving human-agent lineage.
  - **Rich Authorization Requests** for structured intent objects instead of broad scope strings.
  - **ABAC policy checks** for context-aware authorization at every tool call.
  - **Human approval gates** for high-risk or irreversible actions.

5. Tamper-Evident Forensic Trails

  Standard logs are not enough for agentic systems. Infrastructure logs may show an API hit. Model inference logs may show a prompt and response. Orchestration logs may show workflow status. But none of those automatically prove who authorized the action, which agent instance executed it, which policy allowed it, or whether the record was modified later.

  Agent governance needs forensic evidence packets.

  A useful evidence packet should capture the triple identity of the transaction: the human authorizer, the specific AI agent instance, and the tool or resource accessed. It should also include the delegated scope, runtime policy decision, timestamp, action parameters, result, and cryptographic proof.
  [[8]](#ref-8)

  For tamper evidence, each record can be canonicalized, hashed, and linked to prior records. IETF work on Agent Audit Trail formats points toward cryptographically verifiable logging for autonomous systems.
  [[9]](#ref-9)
  Merkle-tree structures can also support efficient inclusion proofs, allowing an auditor to verify that a specific action exists in a log without reading the entire dataset.
  [[10]](#ref-10)

    Minimum Agent Action Evidence Packet

        Field
        Purpose

        Agent ID
        Identifies the non-human actor.

        Agent instance ID
        Identifies the specific runtime instance, not just the agent class.

        Principal ID
        Identifies the human or organization that delegated authority.

        Delegated intent
        Defines the purpose and permitted task.

        Authority scope
        Defines allowed tools, resources, actions, and limits.

        Policy decision
        Records why the action was allowed, denied, or escalated.

        Tool invocation
        Records the tool or API called and its parameters.

        Outcome
        Records result, error, rollback, or completion state.

        Timestamp
        Establishes ordering and duration.

        Hash / signature
        Makes later modification detectable.

6. Estonia and the Sovereign Agent Layer

  Estonia is important because it already treats digital identity as public infrastructure. Its eID, digital signatures, e-Residency, and X-Road data-exchange architecture made the country a reference point for digital government.
  [[11]](#ref-11)

  Its AI-agent ID proposal extends that logic. If humans and companies can have digital identity, then software agents acting on their behalf also need recognizable, controllable, auditable identities.
  [[1]](#ref-1)
  [[12]](#ref-12)

  But the deeper lesson is not simply that agents need IDs. The lesson is that agent identity must be tied to delegated authority and verifiable evidence.

  Estonia also has an existing pattern for tamper-evident integrity infrastructure through Guardtime’s KSI blockchain and secure data-exchange through X-Road. Those patterns suggest what sovereign-grade agent infrastructure may eventually require: identity, delegation, interoperability, policy enforcement, and evidence.
  [[13]](#ref-13)

    The agentic state will not be built on identity alone. It will require bounded machine authority and evidence-producing execution.

7. The Market Gap

  In the United States, the technical market is moving faster than the legal framework. Federal guidance from NIST, CISA, OMB, and executive orders remains largely advisory or agency-scoped. Meanwhile, startups and major cloud vendors are already building runtime policy engines, agent identity systems, MCP gateways, hardware-backed execution environments, and tamper-evident audit tooling.

  The legal question remains unsettled: what makes an AI-agent action log reliable, authentic, and admissible after something goes wrong?

  Courts still rely on traditional evidence principles such as relevance, authenticity, reliability, and expert testimony. There is no uniform U.S. rule requiring cryptographic AI-agent logging. That gap creates the next infrastructure opportunity.

  Enterprises will not only need to control agents. They will need to prove control.

  This is where the market shifts from generic governance to admissibility-aware execution records.

8. Conclusion: The Moat Is the External Enforcement Layer

  A startup’s moat in AI agent governance is not the LLM it uses. Models will change. Frameworks will change. Tool protocols will evolve.

  The defensible layer is the external runtime authority system: a Policy Enforcement Point that sits between agent intent and real-world action.

  That layer should bind human intent to ephemeral agent action, enforce Attribute-Based Access Control at every tool call, prevent confused deputy failures, and produce tamper-evident forensic evidence.

  The future of agent governance is not markdown policies and trust. It is runtime authority, immutable boundaries, and evidence packets.

  Identity gives the agent a name. Authority gives it boundaries. Evidence makes it accountable.

References

  -
    Government of Estonia. “Prime Minister Michal: Estonia to become first country to create digital identities for AI agents.”
    [
      https://valitsus.ee/en/news/prime-minister-michal-estonia-become-first-country-create-digital-identities-ai-agents
    ](https://valitsus.ee/en/news/prime-minister-michal-estonia-become-first-country-create-digital-identities-ai-agents)

  -
    WorkOS. “The developer’s guide to AI agent authentication and authorization.”
    [
      https://workos.com/blog/developers-guide-to-ai-agent-authentication-and-authorization
    ](https://workos.com/blog/developers-guide-to-ai-agent-authentication-and-authorization)

  -
    IETF. “OAuth 2.0 Token Exchange.”
    [
      https://datatracker.ietf.org/doc/html/rfc8693
    ](https://datatracker.ietf.org/doc/html/rfc8693)

  -
    Cloud Security Alliance. “AI Agent Identity Is Solved Backwards.”
    [
      https://cloudsecurityalliance.org/blog/2026/05/08/ai-agent-identity-is-being-solved-backwards-and-the-window-to-fix-it-is-now
    ](https://cloudsecurityalliance.org/blog/2026/05/08/ai-agent-identity-is-being-solved-backwards-and-the-window-to-fix-it-is-now)

  -
    CRN. “12 Agentic AI Startups To Watch In 2026.”
    [
      https://www.crn.com/news/security/2026/12-agentic-ai-startups-to-watch-in-2026
    ](https://www.crn.com/news/security/2026/12-agentic-ai-startups-to-watch-in-2026)

  -
    Aembit. “Aembit Introduces Identity and Access Management for Agentic AI.”
    [
      https://aembit.io/press-release/aembit-introduces-identity-and-access-management-for-agentic-ai/
    ](https://aembit.io/press-release/aembit-introduces-identity-and-access-management-for-agentic-ai/)

  -
    Startup Intros. “Keycard: Funding, Team & Investors.”
    [
      https://startupintros.com/orgs/keycard
    ](https://startupintros.com/orgs/keycard)

  -
    LoginRadius. “Auditing and Logging AI Agent Activity: A Guide for Engineers.”
    [
      https://www.loginradius.com/blog/engineering/auditing-and-logging-ai-agent-activity
    ](https://www.loginradius.com/blog/engineering/auditing-and-logging-ai-agent-activity)

  -
    IETF Datatracker. “Agent Audit Trail: A Standard Logging Format for AI Agents.”
    [
      https://datatracker.ietf.org/doc/draft-sharif-agent-audit-trail/
    ](https://datatracker.ietf.org/doc/draft-sharif-agent-audit-trail/)

  -
    Microsoft. “Agent Governance Toolkit.”
    [
      https://github.com/microsoft/agent-governance-toolkit
    ](https://github.com/microsoft/agent-governance-toolkit)

  -
    e-Estonia. “X-Road.”
    [
      https://e-estonia.com/solutions/interoperability-services/x-road/
    ](https://e-estonia.com/solutions/interoperability-services/x-road/)

  -
    e-Estonia. “eID in the age of AI agents: Estonia’s next leap.”
    [
      https://e-estonia.com/eid-in-the-age-of-ai-agents-estonias-next-leap/
    ](https://e-estonia.com/eid-in-the-age-of-ai-agents-estonias-next-leap/)

  -
    e-Estonia. “KSI Blockchain.”
    [
      https://e-estonia.com/solutions/cyber-security/ksi-blockchain/
    ](https://e-estonia.com/solutions/cyber-security/ksi-blockchain/)