Agents as users
Delegated identity
Delegated identity gives an agent its own identity class carrying a delegation chain that records which agent is acting, for which person, at what scope and until when, rather than a shared service account.
Control sits with the person
When to use it
Any agent acting on a person’s behalf in a system that logs who did what.
What it prevents
Attribution collapse, where two agents share credentials and accountability is lost.
Acting asdelegation chain
AgentLedger, invoice matching
ForAdam, finance
ScopeRead invoices, write match results
UntilEnd of the run, then it expires
A shared service account answers none of these four.
Where it stands
Four architectures recur across deployments: user-delegated, autonomous with a standing identity, hybrid orchestrated, and scoped impersonation.
This entry is a design position rather than a documented pattern. No shipped product and no published paper is cited for it.
Related patterns: Permission parity · Agent registry