What is agent identity?

Picture a Tuesday morning at a hospital. A request arrives to move a patient's surgery slot from Thursday to Friday. It comes through the booking system, politely worded, with the right patient number. The sender says it is an AI agent working for the patient's family.

The person at the desk has a few seconds. Is this agent real? Did the family send it, or did somebody else? Can it move a surgery, or only look at the calendar? If the slot goes wrong, who gets the phone call?

Today the desk can't answer any of that. It has a patient number and a polite message. That gap is what we mean when we talk about agent identity.

The short answer

Agent identity is a record about an agent that someone other than the agent can check. It says which agent this is, which person or company stands behind it, and what it has been allowed to do, and it says whether that permission is still good today.

The word that matters is "check". Anyone can write "I am a trusted assistant of the Sharma family" into a message. An identity is the thing the office looks up for itself, so it doesn't have to take the agent's word.

Three questions, one at a time

Think of the desk at the hospital. There are three things it wants to know, and they are different questions.

Is it real? Some agent exists, it was set up by someone, and it hasn't been made up a minute ago to look official. A record exists and the desk can find it.

Who sent it? A named person or company is answerable. Not "the AI" and not "the platform". Someone you could write to, and who agreed beforehand to answer for what the agent does.

What may it do? Here the question isn't whether the agent is trustworthy in general. It is whether this agent was allowed to move this surgery slot, today, for this family.

Notice that each one is checked at the moment the request arrives. A permission granted last month and quietly withdrawn last week should fail. A desk that checked once at sign-up has no way to notice.

What it isn't

It isn't a login. A login says a known person got in, and the agent often borrows that login. After that, the hospital sees the family's name on everything, whether a person typed it or software did.

It isn't a model score either. Some systems try to guess whether an agent is behaving well by looking at how it writes. That might be useful as a clue for the agent's own operator. It isn't something an office can lean on, because a score is a guess the agent's own side produced, and nobody can show later why it said yes.

And it isn't only a permission. We wrote about that in Read-only is a permission. A scope tells you what an agent may do. It doesn't tell you whom to call.

Why this suddenly matters

For years, software that called a web service was one program run by one company, and the company was known. Agents change that. One person may run several, built by different vendors, each acting for a different task. A hospital, a bank or a tax office may get requests from agents it has never heard of, many times a day.

Inside a single company, this is a manageable problem. Some large identity vendors now let a company list its own agents in its own directory. Microsoft's documentation for Entra Agent ID, dated 1 May 2026, says the product is generally available. As far as we've read, those directories are built for an organisation's own staff and software. They don't usually answer a question from outside, which is exactly the hospital's question. Our longer piece on this goes through it.

What we think a good version looks like

We'd like this to feel closer to a vehicle registration than to anything futuristic. A register anyone can look up. An entry that names who answers for the agent. A permission that is signed by whoever granted it and can be switched off the day it should be. And an office that checks all of it, fails closed when it can't, and keeps its own record of what it saw.

We're setting up a non-profit to work on this, in India first. It isn't incorporated yet, and no government body or company has endorsed it. What exists today is a reference implementation and a lot of questions.

What we don't know

We don't know the right grain for "what may it do". A permission to book hospital slots is too coarse. A permission to move one particular slot is probably too fine to manage. Somewhere between them sits something offices will accept, and we haven't found it.

We don't know how much of this offices will check on their own. Some will want a lot, some will accept a name and a phone number, and the honest answer is that we'd like to hear from them before we guess.

We don't know how agent identity should work for a tiny agent running on a phone with no network. We touched on one version of that in Local processing is not local authority.

And we don't know who answers in law when an agent goes wrong. It could be the person who set the agent up, the company that built it, or the office that let it in, and we expect the answer to depend on the facts. That is a matter for lawyers and regulators, and nothing here is legal advice.