AES FIELD NOTE / AGENT ARCHITECTURE
An AI Agent Needs an Identity, Not Just a Prompt
Why enterprise agents need durable identity, delegation chains, scoped capabilities, short-lived credentials and revocation outside the model session.
Most AI agents are still identified by a name, a prompt and a chat session. That is enough for a demo. It is not enough for an organization.
A company must be able to answer a different set of questions. Who is acting? Who delegated the mission? Under which policy? With access to which systems, data and budget? For how long? And how can that authority be revoked without hunting through every application where the agent has appeared?
The model is an executor. The agent identity belongs to the organizational runtime.
Why the session cannot be the identity
A model session is transient. Context may be truncated. The model may be upgraded. A workflow may hand execution to a different model, a deterministic service or a human operator. If authority is stored implicitly inside the session, every transition either loses necessary context or carries invisible permissions forward.
The failure is conceptual: we confuse the intelligence executing a step with the organizational principal responsible for the work.
In an AI-native company, one durable agent may use multiple models over its lifetime. One model may also execute tasks for many different agents. Identity therefore cannot be derived from the model name, API key or conversation ID.
The durable agent record
The runtime needs a stable record that exists outside any session. It should describe the agent as an organizational participant rather than a software process.
A practical agent identity record
A globally unique identity with owner, organizational home and lifecycle state.
The responsibilities the organization expects, not the tools the agent happens to possess.
The human, strategy or parent agent that granted the current mission and authority.
Explicit limits on systems, data classes, actions, spend, time and downstream delegation.
A continuous record linking decisions and actions back to mission, policy and delegator.
Created, active, suspended, expired or revoked—with state enforced across every execution surface.
Identity is a delegation chain
An agent rarely owns authority by itself. Authority begins with a person, board, policy or operating role and is delegated into a specific mission. The chain must remain visible.
A useful sequence is: principal → role → mission → delegation → capability envelope → session credentials → action receipts.
Each link narrows the one before it. A strategy agent may be allowed to create a campaign mission. The campaign agent may query approved customer segments. A publishing executor may receive one credential valid for one prepared post and one channel. It should not inherit the strategy agent’s broader access.
Credentials should be temporary; identity should be durable
Long-lived API keys collapse identity and access into the same object. Once copied into a workflow, they are difficult to scope, trace and revoke.
The better pattern is to keep the agent identity durable while issuing short-lived credentials for a specific action after policy evaluation. The credential carries only the minimum capability, resource scope, expiry and delegation context required for execution.
- The model never receives a permanent organizational secret.
- A task cannot silently expand its own authority.
- A revoked agent stops receiving new execution credentials.
- Every external action can be attributed to a mission and delegator.
- Changing the model does not change the identity or erase accountability.
Revocation is the real test
Many systems can grant access. Far fewer can withdraw it coherently. If suspending an agent requires editing prompts, rotating shared secrets and checking several SaaS products manually, the organization does not control the agent’s identity.
Revocation should change one authoritative lifecycle state. New credentials must stop immediately. Queued work should be cancelled or held. Active work should reach a safe checkpoint. Downstream delegations should expire according to explicit policy. The evidence record must remain.
What this changes in product architecture
Agent identity cannot be a label inside the chat UI. It becomes a first-class service connected to policy, tasks, memory, approvals, integrations and audit. Every execution request asks not only what the model wants to do, but which organizational identity is asking, under which delegation and with which remaining authority.
This is the boundary between an assistant and a digital colleague. An assistant borrows the user’s session. A governable agent has its own durable identity, receives explicit missions, operates inside a capability envelope and leaves evidence the organization can inspect.
Without durable identity, an agent is a conversation with tools. With it, the agent becomes a controlled participant in the company.
