07.04 · Concept
Agents Acting on Behalf of Users
Give an AI agent an identity of its own and a delegated, scoped authority, so that 'the agent did it' and 'the user did it' are different facts in the log.
Agent actions need separate attribution from user intent: the agent has its own identity, while the user or organisation grants limited authority for specific work. That separation keeps audit trails, revocation, approvals, rate limits and incident handling meaningful when work is delegated, delayed, retried or performed outside a direct user request.
What this lesson answers
- how should AI agents be authorised for user actions
- why not let agents impersonate the user
- how to log delegated agent actions correctly
Notes
When an agent acts for a user, there are two different facts to preserve: who requested the work, and which actor actually performed each action. The user may authorize the agent to do something, but the agent should still have its own identity in your system. That lets logs, approvals, rate limits, revocation, and incident response distinguish “Alice clicked delete” from “Agent-123 deleted after Alice delegated access.”
A useful mental model is a contractor with a badge. The contractor is not the employee, but the employee or company can grant the contractor limited permission to enter…
References
Common questions
- Should an AI agent use the user's credentials?
- No. Sharing or replaying user credentials collapses two separate facts into one: the user authorised work, and the agent performed it. The safer pattern is delegated access, where the agent authenticates as itself and carries scoped permission that records who granted the authority.
- What should an audit log record for agent actions?
- The log should show the agent as the actor, the user or organisation that delegated authority, the permission scope involved, and the operation performed. That makes it possible to distinguish a direct user action from work carried out later or automatically by an authorised agent.
- How is scoped delegation different from a service account?
- A shared service account hides which agent acted and whose authority it used. Scoped delegation gives each agent its own identity and a limited grant tied to a delegating party. That supports narrower permissions, cleaner revocation and better investigation when behaviour is unexpected.
Short definition: what is Agents Acting on Behalf of Users?