In the Google agent identity architecture examined here, an agent can have its own cryptographically verifiable identity and serve as a principal in IAM systems.
But the agent’s identity does not yet determine the authority under which it acts.
Google distinguishes between an agent acting on its own authority and an agent acting with authority delegated by a user. The agent can therefore remain the same identifiable principal while the authority context behind a specific action changes.
This means that three questions need to be kept separate:
Who is acting?
On whose authority is it acting?
What is it authorized to do?
Cryptographic identity makes the agent identifiable. Its status as a principal makes the agent an identifiable subject of authorization. For authorization, this means that alongside the identified principal, the authority context under which the action takes place also becomes relevant.
The structure is therefore not simply:
Identity → Permission.
Rather:
Agent Identity → Principal
+ Authority Context → own or delegated
→ Authorization → authorized scope of action
This distinction becomes particularly relevant for reconstruction. If the same agent can act under different authority contexts, knowing which agent performed an action is not sufficient to reconstruct the governance conditions under which that action took place.
This distinction also becomes relevant for audit reconstruction: the Google architecture can keep agent identity and, in cases of delegation, user identity separately visible.
But even this does not fully represent the authority context. The identity of the delegating user shows to whom a delegation can be attributed. By itself, it does not determine what authority actually applied to the specific action.
Stable identity does not imply stable authority.
This does not, however, resolve the authority problem.
A verifiable agent identity and an attributable delegation do not by themselves determine how long delegated authority remains valid, how tightly it is bound to a specific action, or what happens if that authority changes between authorization and execution.
These are separate control conditions.
The governance question therefore extends beyond identifying the executing agent:
If the same agent can act under different authority contexts, what must remain reconstructable about the authority behind each individual action?
Reference:
Google Cloud, Agent Identity Overview