Apr 6–12, 2026

New Runtime synthesis · Oct 27

Agent identity is being recast as a short-lived delegation chain, not a reused login

The week's signal is that agent identity is being specified as a chain of constrained delegation, not as another login. An OAuth Internet-Draft proposes short-lived transaction tokens that distinguish the human principal from the acting agent and keep the delegation context attached to the token. That recasts access as something granted for a transaction, with the human and the agent remaining distinct, instead of a session the agent can reuse as if it were the user.

The tension is that this is a proposal: an OAuth Internet-Draft, not a finished rule. Short-lived, constrained transaction tokens would make identity designs that collapse the agent into the user's login harder to defend, and would raise the cost of grants that cannot expire with the transaction or carry delegation limits. Builders and buyers who grant agents account access should check whether they can distinguish the human principal from the acting agent and bind that distinction to a short-lived, constrained token, because that is the bar the draft puts on the table.

Key stories

1. Agent Identity Is Becoming A Delegation Chain, Not A LoginShows agent identity being specified as short-lived transaction tokens that keep the human principal distinct from the acting agent and carry constrained delegation, rather than as a login.