[Theme] Provenance of Authority for Agentic AI

Theme Name

Provenance of Authority for Agentic AI — where an agent's authority originates, what it contains, and how it travels

Proposer

Pam Dixon, World Privacy Forum

Summary

Every theme now before the group — the six candidate themes from the 29 July meeting and the proposals opened since — operates on authority that is presumed to already exist. Design-based identity expresses it, intent-based policy constrains it, attestation verifies the state of the thing exercising it, discovery advertises it, cross-border trust management translates it, and the trust stack layers it; the accountability proposal (#1) reconstructs its exercise after the fact. None of them specifies where that authority originates, what may and may not be conferred on an agent at all, how limits and conditions travel with a delegation as it composes and re-delegates across operators, or how any link in a delegation chain traces back to a human or institutional principal with standing to grant it. This theme proposes to treat provenance of authority as a first-class property of agentic systems: the foundation the other themes presuppose, specified rather than presumed.

Scope / Open Questions

Exploration of this theme would need to cover the origination of authority: which humans, organizations, or public authorities have standing to grant authority to an agent, and what distinguishes possessing authority from having been granted it. It would need to cover the content of a grant — mandate, scope, limits, revision conditions, and a contestation route — carried as data that travels with the delegation, rather than as policy held at any single operator's perimeter. It would need to cover what cannot be conferred: whether there are categories of authority no principal can delegate to an agent, and how a specification expresses that floor rather than leaving it to each deployment. And it would need to cover survival under composition: what happens to provenance when agents re-delegate, compose at runtime into configurations no single party holds, or re-advertise capabilities several hops from the originating principal.

Open questions, more than answers at this stage: What does a relying party actually evaluate — the agent, or the conformance of the operating authority structure to the authored one? Where do the gates sit — at assignment, at composition, at re-advertisement? How does revocation propagate through a chain that has already composed? What is the status of authority that was never crisply authored — a natural-language goal handed to an agent — where no clean reference exists to evaluate against? And where is the boundary between the technical carriage of provenance and the questions of law and policy that carriage makes answerable?

Related Work

Existing identity and authorization standards (X.509, OAuth/OpenID Connect, SAML) answer who an agent is and what access it has been given; none carries the origin, mandate, or limits of its authority. W3C Decentralized Identifiers and Verifiable Credentials offer carriage formats such a property could ride in. IETF RATS addresses attestation of an agent's state — a sibling verification discipline that does not reach the authority question. The FAIR data principles established the precedent that provenance can be specified as a first-class property of an object rather than treated as an audit afterthought. Council of Europe work on identity in AI systems, and emerging agentic authorization protocols, are each moving toward this territory without yet naming it.

Forthcoming World Privacy Forum research on identity in AI ecosystems builds on remarks on perpetual KYC and persistent identity delivered at the inaugural meeting of the Council of Europe's Committee on New and Emerging Technologies (CDNET), 15 April 2026 (https://worldprivacyforum.org/posts/remarks-of-pam-dixon-to-the-council-of-europes-inaugural-meeting-of-the-committee-on-new-and-emerging-technologies/).

Related Themes

This theme sits beneath the current set rather than beside it. Design-based Agent Identity gives an agent something to be; this theme gives its authority somewhere to come from, and the two would need to bind. Remote Attestation verifies the state of the actor; this theme supplies the reference that makes the authority side of that verification possible. Sovereign Discovery and Cross-border Trust Management advertise and translate capabilities whose legitimacy this theme would make checkable. The Agent Identity and Trust Stack is the natural structural home: provenance of authority could be developed as the foundation layer of that stack, and I would welcome exactly that conversation. Issue #1 (accountability and attribution after an agent has acted) is the downstream consumer: a record of which agent acted under whose delegated authority can only be reconstructed later if provenance was a specified property at the time of the act. Issue #3 raises delegation of authority as one policy question among several; this theme is the technical substance of that question.

Discussion

Open. The scope above is what exploration of this theme would need to cover; the mechanisms belong to the group's work, not to this proposal.