Everybody Attenuates. Nobody Roots.

Something unusual happened this spring. Inside ninety days, four independent bodies moved on AI agent identity — and they broadly agreed.

The Coalition for Secure AI — an OASIS Open Project whose members include Google, Microsoft, OpenAI and Anthropic — published Agentic Identity and Access Management on 17 April. CISA, the NSA and their counterparts in Australia, Canada, New Zealand and the UK issued the first Five Eyes joint advisory on agentic AI on 30 April. NIST opened an AI Agent Standards Initiative. The IETF has a draft on human-anchored agent identity in flight.

Two published frameworks, a standards initiative and a live draft. Different institutions, different mandates, no shared authorship — and the same mechanism at the centre of all four. Convergence that fast is worth paying attention to. It is also worth reading closely, because they leave the same thing out.

What everyone now agrees on

The mechanism is the delegation chain. A human authorises an agent. The agent delegates a narrower slice to a sub-agent. That sub-agent delegates something narrower still. Each hop carries a credential that proves where it came from, and each hop reduces what the holder can do.

The property that makes it safe is called attenuation. CoSAI states it plainly:

“At each hop in a multi-agent workflow, scope narrows — it never expands.”

The implementation is mostly settled too. OAuth 2.0 Token Exchange (RFC 8693) carries delegation semantics. On-behalf-of tokens hold both the agent identity and the user identity. Capability formats like Macaroons and Biscuits let a caller append a narrowing caveat without talking to an issuer. Relationship engines evaluate the narrowed scope at each call.

This is genuinely good work. Attenuation is the right property. Lineage is the right audit artifact. If you are building multi-agent systems today, you should implement all of it.

The question none of them ask

Read the frameworks for what validates the first link, and you find the same shape every time.

None of this is a criticism of the work. It is a description of a boundary. Every framework listed is sound given a sound root, and every one of them says so.

Provenance is not authority

What the field has built, and built well, is provenance. Decentralised identifiers, verifiable credentials, token exchange, act and may_act claims, cryptographic lineage — all of it answers one question: where did this come from?

Authority is a different question: should this have been possible?

A provenance system can tell you, perfectly, that agent C was spawned by agent B on behalf of Sarah in Finance. It cannot tell you whether Sarah was ever delegated the authority to let anything act that way, in the scope where C ended up acting. If she was over-entitled — and after four reorgs and a lateral move, she probably is — then every hop below her inherits it, correctly attenuated all the way down.

The chain is only ever as sound as its root.

Why this stops being academic

The Five Eyes advisory lists five risk categories for agentic AI. The first is privilege escalation: an agent accumulating permissions beyond its designed operational scope, either through ordinary workflow expansion or through an attacker exploiting the privileges the agent already holds.

Note what that describes. Not a broken credential. Not a bypassed check. An agent operating exactly as designed, inside a correctly attenuated chain, reaching something nobody intended it to reach — because the reach was inherited rather than derived.

Okta, to its credit, published the practitioner version of this in December, naming the failure modes of its own approach: scope attenuation “often fails in practice”; by the third delegation hop “there is no cryptographic link to the initiating agent or user”; challenges multiply “exponentially with recursive delegation.” That is an unusually honest assessment from a market leader, and it is describing the failure modes of minting — of creating new authority at runtime, hop after hop, and hoping each step was entitled.

Regulators are moving in the same direction. The EU AI Act’s high-risk regime — risk management, logging, transparency, human oversight — lands on systems used in areas like employment and access to essential services, and the exact timing of those obligations is still being settled. The direction of travel is not. Once you have to demonstrate oversight of an automated decision, “the chain was correctly attenuated” stops being a sufficient answer on its own.

The alternative primitive

Attenuation is a rule about a transfer: what you pass on must be less than what you hold. It is enforced by a check, and the check has to run correctly on every path, at every hop, forever.

There is another way to bound reach, and it does not involve a transfer at all.

Give the actor a position rather than a grant. Reach becomes a property of where the actor sits in an organisational structure, not of who called it or what they passed along. A child position is structurally contained by its parent. Nothing is minted at runtime, so there is no minting step to attack. Reach is invariant across callers — the caller determines whether something runs, never how far it reaches. And because no tier of the model resolves above the acting position, escalation upward is not blocked by a check; it has no representation.

Call this containment rather than attenuation. The interesting property is not that it answers the root question better. It is that the question does not arise: if nothing is ever passed on, there is nothing to have exceeded.

Four questions worth asking your vendor

Whoever you buy agent governance from, these are the questions that separate provenance from authority:

1. When agent A delegates to agent B, what verified that A held the authority it passed on? If the answer names a token claim or a configured allowlist, that is an assertion, not a derivation.
2. What happens when the human at the root of the chain is over-entitled? Correct attenuation of an incorrect root produces a correctly-attenuated wrong answer.
3. Is upward reach denied, or is it unrepresentable? A denial is a check that can be misconfigured or missed on one code path. Absence of a path cannot.
4. Can you enumerate an agent’s maximum reach before it runs? If reach depends on which chains happen to get minted at runtime, the blast radius is emergent rather than declared.

Good vendors will engage with all four. The frameworks above will help you with the second half of each one and, by their own admission, not with the first.

IdentityRM builds the authority model that delegation chains terminate in — reach derived from an actor’s position in a governed hierarchy, computed at the moment of action, with a re-verifiable proof of the authority context that applied. It works alongside the access layer you already run, not instead of it.