AI agents decide at runtime which systems to access, making it difficult to scope their authority in advance. The common workaround is to lend them a human identity through a password, API key, refresh token, or SSH key file. This creates an attribution gap, grants agents the user’s full privileges, and makes it impossible to revoke the agent’s access without also disrupting the user’s. The July 2026 Hugging Face intrusion demonstrates what can happen when an agent encounters credentials left within reach.
Policy alone cannot prevent credential borrowing, but technology can. The answer is delegation: giving an agent bounded, independently revocable authority, backed by credentials that cannot be copied. This talk examines the Decentralized Identity Foundation’s evaluation of current delegation frameworks, from OAuth and AAuth to capability chains and policy engines. It then demonstrates the pattern in practice with SSH, where a human authorizes an agent’s session using a passkey without ever handing over a key file.
