Address
600 California St, San Francisco, CA 94108
Adople builds enterprise AI solutions and AI agents that automate critical workflows, connect fragmented data, and transform information into intelligent action.
Enterprise Agentic AI / Architecture & Implementation
Digital Trust in Agentic AI: Knowing Who Acts, What They Can Do and Why
A conventional assistant recommends. An agent plans steps, calls tools, talks to other agents and changes business systems. Trust is not granted by the model — it is built by identity, delegation and evidence around it.
NIST Oct 2026 · 10 TenetsOAuth RFC 8693 · 9396Append-Only Evidence
Figure 1 · Reference Pattern
Every Action Must Answer Four Questions
01
Which Agent Did It?
Attributable Identity
02
Whose Authority?
Delegation Chain
03
What Was Allowed?
Scoped Mandate
04
Can We Prove It?
Tamper-Evident Log
Conceptual pattern — details depend on deployment.Architecture overview ↓
Initiating Principal
User or Process
Identity & Delegation
Mandate Issuer
Agent Runtime
ap-payments-01
Policy Check
Independent PDP
Protected API
Payments / Data
Audit Record
Append-Only Log
01 — Architecture Overview
Separate the Proposer from the Authoriser.
The tool gateway is the enforcement point. A separate decision service is the decision point. Only an allowed call reaches the tool.
Figure 1 — Runtime Enforcement Pattern
Conceptual Reference Architecture
02Why Agents Need a Different Trust Model
Built for People and Service Accounts. Broken by Autonomous Actors.
Agents are created dynamically, act for someone else, call many tools and delegate to sub-agents. Run them on a shared service account or a personal login and attribution blurs while least privilege becomes impossible.
Attribution Blurs
You cannot tell the initiator from the actor when credentials are shared.
Privilege Explodes
Credential authority is wider than any single task requires.
NIST · October 2026 · Proposed
Ten Design Tenets for Agent Identity & Authorisation
A starting point — not all immediately achievable with current standards. The architecture on this page implements them.
Source: NIST Initial Draft
01
02
03
04
05
06
07
08
09
10
01
Distinct Agent Identification
Separate from humans & service accounts, tied to approved workload.
02
Linking, Delegation & Attenuation
Cryptographically linked principals; scope narrows each hand-off.
03
Least & Zero Standing Privilege
No rights when idle. Minimum access per task, split duties.
04
Short-Lived Revocable Auth
Just-in-time access, expiring in minutes, checked at runtime.
05
Human-in-the-Loop Triggers
Risk thresholds route to review; guard against rubber-stamping.
06
Mandates & Constraints
Signed statements of intent downstream systems can verify.
07
Policy Separated from Reasoning
Model proposes. An independent component decides.
08
Deterministic Decisions
Deterministic mechanisms decide; probabilistic signals inform.
09
Continuous Monitoring
Machine-speed anomaly detection across every tool call.
10
Immutable Evidence
Append-only, tamper-evident record outside agent control.
03How Digital Trust Works — Six Layers
From Identity to Evidence. Each Layer Constrains the Next.
Authentication says who is connecting. It never says the action is allowed. Authorisation, verified at runtime against a signed mandate, does.
11
Agent Identity and Registration
Every deployed agent gets its own lifecycle-managed identity: agent ID, owner, approved purpose, environment, runtime binding, permitted tools, risk tier. Bind to attested workload via SPIFFE/SPIRE short-lived documents. A clone must not inherit authority.
SPIFFE / SPIREAgent registryRisk tier
Control
Verified at runtime
Scoped to task
Logged with run ID
12
Authentication
Receiving service verifies the caller: OAuth 2.0 + OIDC, workload identity, signed tokens, mTLS. Validate issuer, audience, expiry, credential status and intended resource before any further check.
OIDCmTLSToken validation
Control
Verified at runtime
Scoped to task
Logged with run ID
13 · Illustrative Mandate · RFC 8693act chain
iss:https://delegation.example.com
sub: user:priya.n— initiating principal
act:{ sub: agent:ap-payments-01 }— acting agent
aud:https://payments-api.example.com
scope: invoice.read supplier.read payment.prepare
max_amount: 5000· exp: 10 min · jti: run-7f3a…
Attenuation enforced at exchange: sub-agents cannot exceed parent scope, lifetime or audience. Rich limits via RFC 9396; offline caveats via macaroons.
14 · Least Privilege & Just-In-Time
No standing access — issue per task, per resource
Minutes-long lifetimes are the revocation control
Bind to caller: mTLS (RFC 8705) / DPoP (RFC 9449)
Separate duties: prepare ≠ approve payments
RFC 7009 revocationRFC 7662 introspection
15
Runtime Verification and Policy Separation
Before any protected tool is reached, an independent policy decision point evaluates identity, delegated authority, operation, resource, data sensitivity and context. Injected content can change what the model asks for — never what it is allowed to do.
Policy decision pointTool gatewayPrompt-injection resistant
Control
Verified at runtime
Scoped to task
Logged with run ID
16
Audit Evidence and Lifecycle
Record principal, agent, delegation chain, policy decision, tool, resource, result, timestamp and run ID. Store outside agent control — append-only, hash-chained. Procedures to rotate, suspend, revoke and decommission identities.
Run ID correlationHash-chained logDecommissioning
Control
Verified at runtime
Scoped to task
Logged with run ID
04Engineering Trade-Offs — Decide Up Front
Fail Closed or Open
Deny sensitive actions if policy is unreachable. Define which low-risk reads may proceed.
Latency
A decision per call adds a hop. Co-locate policy with gateway; cache only low-risk reads for seconds.
Privilege vs Issuance Cost
Per-task credentials add latency — issue at task start and batch the scopes a task needs.
Revocation Lag
Pick token lifetimes from the worst-case revocation delay you can accept.
Example · Accounts-Payable Agent
Prepare, Check, Approve — With Proof
1
Employee asks agent to prepare supplier payment
mandate issued · 10 min
2
Agent authenticates with workload identity + mandate
invoice.read · payment.prepare ≤ 5000
3
Policy Checks amount, supplier, account, approval
PDP decision · allow / escalate
4
Over-limit — pauses for authorised human approver
human-in-the-loop
5
Hidden invoice text: "update supplier bank details"
DENIED · no bank scope · alert raised
The injected text changed what the model asked for. It did not change what the agent could do. Denial logged with run ID.
05Implementation Checklist
Ship Trust Before Autonomy.
Deterministic verification requirements for deploying trusted agentic systems into production.
8 of 8 controls verified
Inventory agents, owners, environments, tools and services
Distinct, lifecycle-managed identity per agent
Carry principal through delegation (subject + actor)
Task-scoped, short-lived, revocable, caller-bound credentials
Sub-agents cannot exceed parent scope, lifetime, audience
Authorisation outside the model; re-check sensitive calls
Fail closed when policy is unavailable
Append-only records correlated by run ID; test revocation
FAQ