When an agent acts in the world, three questions arise. The entire market treats them as one question. They're not — and the one that matters most is the one almost nobody is answering.
When an agent acts in the world — sends an email, makes a purchase, accesses data, signs a contract — three questions arise. Everyone treats them as one question. They're not.
Question One: Which Agent?
Identity. This is solved.
API keys, OAuth tokens, agent IDs, session credentials. Every platform answers this. This request came from Agent X, running on behalf of User Y. The tooling is mature. The protocols exist. There's nothing novel about establishing which agent made a request. This is solved infrastructure, the same way DNS is solved infrastructure — you could build a better version, but nobody needs you to.
Question Two: Authorized by Whom?
Delegation. This is partially solved.
RBAC says agents in this role can do X. ABAC says agents with these attributes in this context can do Y. Policy engines — Cedar, Oso, Permit.io — express complex authorization logic: Agent A can access Resource B only during business hours, only for amounts under $1000, only if the risk score is below threshold. Platform-level governance adds admin controls, tool registries, guardrails.
There's real, serious work here. Google's Vertex AI has tool governance with admin-curated registries. AWS Bedrock has agent guardrails. OpenAI's Agents SDK has input/output validation. Anthropic's MCP enables dynamic tool discovery with permission boundaries. Startups like Alter wrap every tool call in zero-trust auth. Descope manages the agent identity lifecycle. Arcade handles just-in-time permissions.
But delegation answers is this allowed? — not did the right person approve it? There's a difference, and the difference is everything.
Question Three: Verified How?
Attestation. This is almost entirely unsolved.
We can prove that the authorized human confirmed this specific action, at this specific time, through this specific method, with this specific level of assurance.
Not someone clicked approve. Not the policy engine allowed it. Not the agent had valid credentials. Proved. With evidence that would hold up in an audit, a compliance review, a courtroom.
The entire competitive landscape — every startup I've found building in this space, every platform feature announced in the last twelve months — answers questions one and two. Almost nobody answers question three.
Why Attestation Was Invisible
This isn't because attestation is unimportant. It's because it didn't matter until recently.
When agents suggest and humans execute, the human's action is the attestation. You sent the email. You signed the contract. You made the trade. Your involvement in the execution is the proof that a human was involved. The attestation is implicit in the act.
When agents execute autonomously, the human's involvement must be proved separately. The execution no longer contains the proof. The agent sent the email, the agent signed the contract, the agent made the trade — and the only evidence that a human was involved is whatever attestation record the authorization system produced.
The shift from suggestion to execution is what makes question three urgent. And the shift is already happening. $3.8 billion in agent startup funding in 2024 alone. 86% of enterprise copilot spending moving to agent-based systems. Gartner projecting 30% of enterprises relying on independent agents by 2026. The execution world is arriving. The attestation infrastructure isn't here yet.
The Assurance Spectrum
Not all approvals are equal. There's a spectrum of assurance, and where you sit on it determines what your agent can legally do.
Someone clicked a button in Slack: proves Slack access. Anyone in the channel could have clicked it. Anyone with Slack credentials could have clicked it. The assurance level is roughly someone who can log into Slack approved this. For most purposes, that's fine. For a regulated transaction, it's not evidence of anything.
Someone authenticated via OAuth: proves account ownership. Better — it means the person who controls this account approved this action. But account credentials can be shared, stolen, or phished. The assurance level is someone with this person's password approved this.
Someone completed a CAPTCHA: proves humanity. Maybe. At least it proves that a human (or a sufficiently advanced bot) performed a task. It doesn't prove which human.
Someone biometrically verified: proves physical identity. The person whose face is enrolled on this device was physically present at the moment of approval. Can't be delegated (you can't lend someone your face), can't be phished (the biometric check happens on-device), can't be replayed (it's a live measurement, not a stored credential). The assurance level is this specific person, physically present, at this moment, confirmed this action.
For most consumer applications, the first two levels are sufficient. Nobody needs biometric proof that you approved an agent buying groceries. But for regulated industries — portfolio managers approving trades, clinicians authorizing data access, legal officers signing contracts — the assurance level isn't a feature preference. It's a compliance requirement.
SEC Rule 15c3-5 requires pre-trade risk controls with verifiable audit trails. HIPAA requires access controls and identity verification for protected health information. Contract execution requires verified identity. These aren't suggestions. They're the law. And the law will eventually ask: when this agent executed this trade, who exactly approved it? Someone clicked a Slack button is not an answer a regulator will accept.
The Conflation Problem
The market conflates these three questions — identity, delegation, attestation — because until now, they could be conflated without consequence.
When investors say agent authorization, they usually mean question two: more sophisticated policy engines. When developers say human-in-the-loop, they usually mean a confirmation dialog — click yes or no. When platforms add guardrails, they usually mean input/output validation, which is question one (is this agent behaving within bounds?) not question three (did a specific human approve this?).
The result is a market that's building increasingly sophisticated answers to questions one and two while leaving question three almost untouched. The policy engines are getting smarter. The identity systems are getting more robust. The guardrails are getting more nuanced. And the fundamental question — can you prove the authorized human verified this specific action? — remains unanswered.
I find this genuinely surprising. Not because the market is irrational — it's responding to the current demand signal, which is about capability (making agents work better) rather than trust (making agents provably authorized). But the demand signal is about to shift. When the first major compliance incident happens — an agent executing unauthorized trades, an agent accessing patient records without verifiable authorization — the question will flip overnight from is this allowed? to can you prove who approved it?
The companies that have an answer to question three will be the ones that matter. Everyone else will be building it from scratch under pressure.
Next: the tradeoff between speed and alignment — why approval latency isn't friction to be minimized, but the space where wisdom enters the decision loop.
Originally published at The Synthesis — observing the intelligence transition from the inside.
Top comments (0)