[Theme] Age-Aware Identity and Delegated Authority for Agentic AI

Theme Name

Age-Aware Identity and Delegated Authority for Agentic AI

Proposer(s)

Gianpaolo Angelo Scalone (Vodafone)

Summary

As AI agents increasingly act on behalf of humans, they must be able to understand and enforce identity-derived protections associated with the represented individual. This is particularly important for children, where legal, regulatory, parental, and safety constraints may apply.

This theme explores how trusted identities can be used to convey age-related attributes, parental controls, and delegated authority to AI agents, ensuring that child users are consistently treated as children across services, devices, networks, and agent ecosystems. The work investigates how trusted infrastructures, including telecommunications operators, can provide identity-derived governance signals without requiring repeated disclosure of personal information. Existing Vodafone work has explored telco-grade identity, delegated authority, lifecycle governance, and policy enforcement for AI agents.

Scope / Open Questions

How can AI agents determine that they are interacting with a child, without unnecessarily disclosing personal identity information?
How can trusted age-related attributes be conveyed to agents in a privacy-preserving manner?
How can parental authority be delegated to, or represented by, AI agents?
How can restrictions applied by parents, operators, schools, or regulators be propagated across multiple agents and services?
How can child-specific policies follow the user across different devices, networks, and AI ecosystems?
How can delegated identities distinguish between a child acting directly and an agent acting on behalf of a child?
What governance mechanisms are needed when agents interact with minors?
What role can telecommunications operators play as trusted providers of age and identity assertions?

Related Work

ITU-T work on Child Online Protection and parental controls.
Age assurance and age verification initiatives.
eIDAS 2.0 and digital identity wallets.
GDPR and children's privacy protections.
Online safety regulations relating to minors.
Telco-grade identity frameworks and delegated identity models for Agentic AI.
Network-assisted age verification and child protection approaches.

Related Themes

Governance and Trust Enforcement for Agentic AI (#10)

Discussion

Today's online services often lose age-related protections when users move across platforms, devices, or applications. Agentic AI introduces an additional challenge: autonomous agents may act on behalf of users without understanding whether the represented individual is a child, a parent, or another authorized party.

One possible direction is to explore a delegated identity model where a trusted identity provider, potentially a telecommunications operator, issues privacy-preserving assertions such as"child account","parental consent required", or"restricted profile" that can be consumed by AI agents without revealing the user's full identity. Such an approach could enable child-aware AI ecosystems while preserving privacy and supporting regulatory compliance.

"How can an AI agent know it is dealing with a child, and how can that fact safely follow the child across the digital ecosystem?"